KR20090037366A - Aes encryption/decryption circuit - Google Patents

Abstract

An AES encoding/decoding circuitry is provided to reduce the number of cycles required for the AES encoding by minimizing the difference between the summations of the signal processing time of each sub block conversion. A round feature module(105) is provided as the AES encoding/decoding circuitry. The first AddRoundKey conversion module(110) receives the input signal(165) and the round key A(162), and performs the AddRoundKey conversion. The second AddRoundKey conversion module(114) receives the output of the ShiftRows conversion module(112) and the round key B(163), and performs the AddRoundKey conversion. The SubBytes conversion module(111) receives the output of the first AddRoundKey conversion module(110), and performs the SubBytes conversion. The ShiftRows conversion module receives the output of the SubBytes conversion module, and performs the ShiftRows conversion. The MixColumns conversion module(113) receives the output of the ShiftRows conversion module and performs the MixColumns conversion. The data holding part outputs the output signal of the encoding/decoder.

Description

AES encryption / decryption circuit {AES ENCRYPTION / DECRYPTION CIRCUIT}

The present invention relates to an AES encryption / decryption circuit for executing AES (Advanced Encryption Standard) processing defined as FIPS (Federal Information Processing Standard).

With the recent development of optical fiber networks, anyone can easily use high speed communication on the Internet. It also facilitates large data communications such as high quality video distribution. However, there are threats in the network, including eavesdropping, tampering, and spoofing. To protect network communications from these threats, the demand for encryption is increasing.

Encryption is essential for secure communication, but lowering the transfer rate is undesirable. This trend is particularly noticeable in video distribution where large amounts of data are processed. High speed encryption is required to communicate large amounts of data safely and at high speed.

In a large amount of encrypted communication, a symmetric block cipher is generally used.

The most widely used symmetric block cipher is AES, as defined by Federal Information Processing Standards (FIPS) 197.

In order to cope with high-speed encrypted communication, AES needs to be speeded up using a dedicated hardware accelerator.

60A and 60B show encryption and decryption algorithms of AES. AddRoundKey, SubBytes, ShiftRows, MixColumns, InvSubBytes, InvShiftRows, and InvMixColumns in Figs. 60A and 60B are processes of the same name defined as subblock conversion in FIPS 197. In addition, NR is the number of rounds determined according to the key length, which is 10 in AES-128, 12 in AES-192, and 14 in AES-256.

As shown in Figs. 60A and 60B, the algorithm of AES repeats the round function defined in the specification NR times after the AddRoundKey conversion. The round function includes four processes of SubBytes, ShiftRows, MixColumns, and AddRoundKey for encryption, and four processes of InvShiftRows, InvSubBytes, AddRoundKey, and InvMixColumns for decryption. Exceptionally, the NRth round function includes three processes of SubBytes, ShiftRows, and AddRoundKey for encryption, and three processes of InvShiftRows, InvSubBytes, and AddRoundKey for decryption. The AddRoundKey conversion requires a round key wkeyi, which is generated from a cipher key and whose value changes every round (round key described in FIPS197, where i is the number of rounds). However, wkey0 is the same as the encryption key.

In order to implement the AES algorithm as hardware, all of the AES signal processing must be divided into those that can be executed within one clock cycle period supplied to the AES circuit. For example, in a typical implementation, one round function is executed in one clock cycle, two round functions are executed in one clock cycle, or one round function is executed in two clock cycles. .

In the conventional method, when one round function is executed in one clock cycle, encryption and decryption of the AES-128 requires 11 clock cycles, and two round functions are executed in one clock cycle. The case requires six clock cycles, and when one round function is executed within two clock cycles, 22 clock cycles are required.

AES implemented by hardware may achieve some level of high speed processing. However, the AES processing speed needs to be further increased.

SUMMARY OF THE INVENTION The present invention has been made in view of the above, and provides an encryption / decryption circuit that executes AES processing at higher speed by reducing the number of cycles required for encryption and decryption.

In accordance with a first aspect of the present invention, there is provided an apparatus comprising: a first AddRoundKey conversion module; A second AddRoundKey conversion module; ShiftRows conversion module; SubBytes conversion module; MixColumns conversion module; And a data holding unit, wherein the AES encryption / decryption circuit executes the first AddRoundKey conversion module and the second AddRoundKey conversion module using different round keys in a cycle of encryption.

In accordance with a second aspect of the present invention, there is provided an apparatus, comprising: a first AddRoundKey conversion module; A second AddRoundKey conversion module; InvShiftRows transformation module; InvSubBytes Conversion Module; InvMixColumns transformation module; And a data holding unit, wherein the AES encryption / decryption circuit executes the first AddRoundKey conversion module and the second AddRoundKey conversion module using different round keys in a cycle of decryption.

In accordance with a third aspect of the present invention, there is provided an apparatus comprising: a first AddRoundKey conversion module; A second AddRoundKey conversion module; A third AddRoundKey conversion module; A first ShiftRows conversion module; A second ShiftRows conversion module; A first SubBytes transform module; A second SubBytes transform module; A first MixColumns conversion module; A second MixColumns conversion module; And a data holding unit, wherein the AES encryption / decryption circuit executes the first AddRoundKey conversion module, the second AddRoundKey conversion module, and the third AddRoundKey conversion module using different round keys in a cycle of encryption.

In accordance with a fourth aspect of the present invention, there is provided an apparatus comprising: a first AddRoundKey conversion module; A second AddRoundKey conversion module; A third AddRoundKey conversion module; A first InvShiftRows transformation module; A second InvShiftRows transform module; A first InvSubBytes conversion module; A second InvSubBytes conversion module; A first InvMixColumns transformation module; A second InvMixColumns conversion module; And a data holding unit, wherein the AES encryption / decryption circuit executes the first AddRoundKey conversion module, the second AddRoundKey conversion module, and the third AddRoundKey conversion module using different round keys in a cycle of decryption.

In the present invention, the signal processing in some clock cycles is increased so that the difference between the sum of the signal processing times for each subblock conversion in each clock cycle period is minimized. This can reduce the number of cycles required for AES encryption or decryption by hardware than before.

In the implementation of the present invention, the maximum of the sum of the signal processing times for each subblock conversion in each clock cycle period is the same as that of the prior art. Thus, a reduction in the number of cycles means an improvement in processing speed.

The present invention is applicable to both encryption and decryption (including Equivalent Inverse Cipher). The present invention is applicable to any implementation method such as 1 Round / Cycle, 2 Cycle / Cycle, or 0.5 Round / Cycle. The present invention is applicable to any encryption mode, such as ECB mode or CBC mode. The present invention is applicable for any key length.

As an effect of the present invention, in the implementation method of 1 Round / Cycle, 11 cycles are reduced to 10 cycles in AES-128, 13 cycles are reduced to 12 cycles in AES-192, and 15 cycles are reduced to 14 cycles.

In the implementation of 2 Round / Cycle, six cycles in AES-128 are reduced to five cycles, seven cycles in AES-192 are reduced to six cycles, and eight cycles in AES-256. Reduced to seven cycles.

Further features of the present invention will become more apparent from the following description of exemplary embodiments with reference to the accompanying drawings.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In this embodiment, AES-128 (hereinafter abbreviated to AES) defined in FIPS197 will be described as an example.

<First Embodiment>

Fig. 1 shows a comparison between the processing contents of encryption executed in clock cycles in the prior art and the first embodiment.

Referring to Fig. 1, the cycle count represents a clock cycle count that is "0" at the start of the AES process. The round key wkeyi (i is the round number) is a round key described in FIPS197.

In the present embodiment, AddRoundKey conversion, ShiftRows conversion, SubBytes conversion, and MixColumns conversion are executed in the 0th to 8th cycles. In the ninth cycle, the first AddRoundKey transformation, the ShiftRows transformation, the SubBytes transformation, and the second AddRoundKey transformation are executed. As the round key, wkeyO is used in the 0th cycle, wkeyl is used in the lth cycle, ..., and wkey8 is used in the 8th cycle. In the ninth cycle, two round keys wkey9 and wkeylO are used.

In this embodiment, the same processing as in the prior art is executed as a whole. However, in this embodiment, AES encryption can be executed in clock cycles fewer by one.

Next, the sum of the encryption processing times for each subblock conversion in each clock cycle period according to the present embodiment will be described. Fig. 2 is a diagram showing a comparison between the sum of the encryption processing time for each subblock transformation within each clock cycle period of the prior art and the first embodiment. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement this embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period must be less than one clock cycle time. As shown in FIG. 2, the processing time of each subblock transform is the longest in the SubBytes transform, and is short in the order of the MixColumns transform, the AddRoundKey transform, and the ShiftRows transform.

In the present embodiment, the sum of the signal processing times for each subblock transform in each of the 0th to 8th cycles in which AddRoundKey transform, SubBytes transform, ShiftRows transform, and MixColumns transform is performed is performed by AddRoundKey, SubBytes transform, ShiftRows transform It is longer than the sum of the signal processing time for each subblock transform in the ninth cycle in which the AddRoundKey transform is executed. Therefore, in the present embodiment, the maximum value of the sum of the signal processing times for each subblock transform executed within one cycle period is the same as in the prior art. In the prior art, the present embodiment can also be implemented if the maximum value of the sum of the signal processing times for each subblock transformation executed within one cycle period is shorter than one cycle time.

The present invention is also applicable to AES decryption.

Fig. 3 shows a comparison between the processing contents of the decoding executed in the clock cycles of this embodiment and those of the prior art.

Referring to Fig. 3, the cycle count indicates a clock cycle count that is "0" at the start of the processing of the AES.

In the present embodiment, the first AddRoundKey transformation, InvShiftRows transformation, InvSubBytes transformation, and second AddRoundKey transformation are executed in the 0th cycle. InvMixColumns transformation, lnvShiftRows transformation, InvSubBytes transformation, and AddRoundKey transformation are executed in the first to ninth cycles. As the round key, two round keys wkey9 and wkeylO in the 0th cycle, wkey8 in the 1st cycle, wkoy7 in the 2nd cycle, wkeyO in the 9th cycle are used.

In this embodiment, the same processing as in the prior art is executed as a whole. However, in this embodiment, AES decryption can be executed in clock cycles fewer by one.

Next, the sum of the decoding processing time for each subblock conversion in each clock cycle period will be described according to the present embodiment. FIG. 4 is a diagram showing the sum of decoding processing time for each subblock transform and comparison of the prior art in each clock cycle period in the first embodiment. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement this embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period must be less than one cycle time. As shown in FIG. 4, the processing time of each subblock transform is the longest in InvSubBytes transform, and is short in the order of InvMixColumns transform, AddRoundKey transform, and InvShiftRows transform.

 In the present embodiment, the sum of the signal processing times for each subblock transform in each of the first to ninth cycles in which the AddRoundKey transform, InvSubBytes transform, InvShiftRows transform, and InvMixColumns transform are performed is performed by AddRoundKey transform, InvSubBytes transform, InvShiftRows transform, And longer than the sum of the signal processing time for each subblock transform in the 0th cycle in which the AddRoundKey transform is performed. In this embodiment, the maximum value of the sum of the signal processing times for each subblock conversion within each clock cycle period is the same as in the prior art. Thus, the present embodiment can also be implemented.

The above-mentioned features of the present invention are summarized.

In the conventional general implementation method, the round function defined in the standard is regarded as a break in processing, and encryption and decryption are distributed among clock cycles. Thus, the sum of the signal processing times for each subblock transform in the 10th and 0th cycles is shorter than that in each of the 1st to 9th cycles. In other words, the sum of the signal processing times for each subblock transform varies in each cycle.

On the other hand, in the present invention, the signal processing in some clock cycles is increased so that the difference between the sum of the signal processing times for each subblock conversion within each clock cycle period is minimized. In the present invention, the number of clock cycles required for AES encryption or decryption is reduced by one cycle without increasing the sum of signal processing times for each subblock conversion within each clock cycle period. This increases the AES processing speed by about 10%.

Next, a circuit configuration of the AES core for implementing AES encryption and decryption will be described.

5 is a block diagram of an AES core according to the present embodiment.

Referring to Fig. 5, the AES Core 101 executes AES processing. The key expansion unit 102 generates a round key for AES encryption and decryption from the encryption key and outputs the round key. The encryption / decryption unit 103 performs encryption of 128-bit plain text data or decryption of 128-bit cipher text data using the round key supplied from the key expansion unit 102. The control unit 104 receives a control signal from a unit outside the AES core 101 to control signals of the key expansion unit 102 and the encryption / decryption unit 103 and signals outside the AES core 101. Generate a signal to notify the unit of completion of its operation.

Referring to FIG. 5, the input signal 105 is plaintext data that is an object of encryption or ciphertext data that is an object of decryption. The output signal 151 is a result obtained by encrypting or decrypting the input signal 150 with respect to the encryption / decryption unit 103. The encryption key 152 is used for encryption or decryption. The encryption / decryption selection signal 153 selects to perform one of encryption and decryption. The key preparation start signal 155 initiates key expansion for the key extension 102 to generate a round key from the encryption key 152. The control signal 157 enables encryption / decryption processing after one cycle. The encryption / decryption start signal 158 initiates encryption or decryption of the input signal 150. The valid signal 159 indicates that the output signal 151 holds the result of encryption or decryption by the encryption / decryption section 103. The control signal 160 maintains the value of the output signal 151 with respect to the encryption / decryption unit 103. The counter signal 161 represents the number of cycles from the leading edge of the key preparation start signal 155 or the encryption / decryption start signal 158 in key preparation or encryption / decryption. Round key A 162 is one of the round keys. Round key B 163 is a round key generated by key extension 102 and is used in the last cycle of encryption or the first cycle of decryption. The selection signal 170 switches the connection of the subblock transformation in the encryption / decryption section 103. The selection signal 171 switches the target process data in the encryption / decryption unit 103.

In the above configuration, the input signal 150 is input to the encryption / decryption section 103 from the outside. The output signal 151 is output from the encryption / decryption section 103 to the outside. The encryption key 152 is input from the outside to the key expansion unit 102. The encryption / decryption selection signal 153 is input from the outside to the key expansion unit 102, the encryption / decryption unit 103, and the control unit 104. The key preparation start signal 155 is input from the outside to the key expansion unit 102 and the control unit 104. The control signal 157 is output from the controller 104 to the outside. The encryption / decryption start signal 158 is input from the outside to the key expansion unit 102 and the control unit 104. The valid signal 159 is output from the controller 104 to the outside. The output maintenance control signal 160 is output from the control unit 104 to the encryption / decryption unit 103. The counter signal 161 is output from the control unit 104 to the key expansion unit 102. The round key A 162 is output from the key expansion unit 102 to the encryption / decryption unit 103. The round key B 163 is output from the key expansion unit 102 to the encryption / decryption unit 103. The selection signal 170 is output from the control unit 104 to the encryption / decryption unit 103. The selection signal 171 is output from the control unit 104 to the encryption / decryption unit 103.

Next, the encryption / decryption unit 103 will be described. 6 is a block diagram of the encryption / decryption unit 103. Referring to FIG. 6, the modified round function module 105 executes one cycle of encryption using the round key A 162 and the round key B 163 under the control of the selection signal 170. The modified round function module 106 performs decryption using the round key A 162 and the round key B 163 under the control of the selection signal 170.

The selector 107 selects one of the output from the modified round function module 105 and the output from the modified round function module 106 in accordance with the encryption / decryption selection signal 153. The data holding unit 108 holds the signal selected by the selector 107 in accordance with the output holding control signal 160. The selector 109 selects one of the input signal 150 and the output signal from the data holding unit 108 in accordance with the selection signal 171.

Referring to FIG. 6, the input signal 165 is input to the modified round function modules 105 and 106. The output signal 166 is the result obtained by processing the input signal 165 for the modified round function module 105. The output signal 167 is the result obtained by processing the input signal 165 for the modified round function module 106. The output signal 168 is output from the selector 107.

In the above configuration, the input signal 150, the output from the data holding unit, and the selection signal 171 are input to the selector 109. The output of the selector 109, the round key A 162, the round key B 163, and the selection signal 170 are input to the modified round function module 105. The output of the selector 109, the round key A 162, the round key B 163, and the selection signal 170 are input to the modified round function module 106. The output signal of the modified round function module 105, the output signal of the modified round function module 106, and the encryption / decryption selection signal 153 are input to the selector 107. The output of the selector 107 and the output holding control signal 160 are input to the data holding unit 108. The data holding unit 108 outputs an output signal 151 of the encryption / decryption unit 103.

In the above configuration, when the selection signal 171 is negated, the selector 109 selects and outputs the input signal 150. When the selection signal 171 is asserted, the selector 109 selects and outputs the output signal 1651 of the data holding unit 108. The input signal 165, the result of being selected by the selector 109, is input to the modified round function modules 105 and 106, which perform encryption and decryption, respectively. When the encryption / decryption selection signal 153 is negated, the selector 107 selects and outputs the output signal 166 which is the output result of the modified round function module 105. When the encryption / decryption selection signal 153 is asserted, the selector 107 selects and outputs an output signal 167 which is the output result of the modified round function module 106. The output signal 168 of the selector 107 is input to the data holding unit 108 and temporarily stored. The output signal 151 of the data holding unit 108 is an output signal of the encryption / decryption unit 103. The output signal is also connected to the input of the selector 109. When the selection signal 171 is asserted, encryption by the modified round function module 105 or decryption by the modified round function module 106 is repeatedly executed.

When the encryption / decryption is finished and the next encryption / decryption has not yet started, the control unit 104 asserts the output maintenance control signal 160. During this time, the data holding unit 108 keeps the value of the output signal 151 without depending on the output signal 168.

Next, the modified round function module 105 will be described. 7 is a block diagram of a modified round function module 105. Referring to FIG. 7, the AddRoundKey conversion module 110 (corresponding to the first AddRoundKey conversion module) receives an input signal 165 and a round key A 162 and performs AddRoundKey conversion. The SubBytes conversion module 111 receives the output of the AddRoundKey conversion module 110 and performs SubBytes conversion. The ShiftRows conversion module 112 receives the output of the SubBytes conversion module 111 and executes ShiftRows conversion. The MixColumns conversion module 113 receives the output of the ShiftRows conversion module 112 and executes MixColumns conversion. The AddRoundKey conversion module 114 (corresponding to the second AddRoundKey conversion module) receives the output of the ShiftRows conversion module 112 and the round key B 163 to execute AddRoundKey conversion. The selector 115 selects and outputs one of the output of the MixColumns conversion module 113 and the output of the AddRoundKey conversion module 114 according to the selection signal 170. The output signal of the selector 115 is the output signal of the modified round function module 105.

In the above configuration, when the selection signal 170 is negated, the selector 115 selects and outputs the output of the MixColumns conversion module. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module.

Next, the modified round function module 106 will be described with reference to the block diagram of FIG. 8.

Referring to FIG. 8, the InvMixColumns transformation module 116 receives an input signal 165 and performs InvMixColumns transformation. The AddRoundKey conversion module 117 receives the input signal 165 and the round key B 163 and performs AddRoundKey conversion. The selector 118 selects and outputs one of an output of the InvMixColumns conversion module 116 and an AddRoundKey conversion module 117 according to the selection signal 170. The InvShiftRows transformation module 119 receives the output of the selector 118 and executes InvShiftRows transformation. The InvSubBytes conversion module 120 receives the output of the InvShiftRow conversion module 119 and performs InvSubBytes conversion. The AddRoundKey conversion module 121 receives the output of the InvSubBytes conversion module 120 and performs AddRoundKey conversion. The output of the AddRoundKey conversion module 121 is the output of the modified round function module 106.

In the above configuration, when the selection signal 170 is negated, the selector 118 selects and outputs the result of the InvMixColumns conversion module 116. When the selection signal 170 is asserted, the selector 118 selects and outputs the output of the AddRoundKey conversion module 117.

Next, the encryption operation in the above configuration will be described. 9A and 9B are timing charts of encryption according to the present embodiment. 9A and 9B, the abscissa represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse.

The three digits on the vertical axis at the left end of Fig. 9A represent signal lines and correspond one-to-one to the reference numbers of the signal lines used in Figs.

The encryption operation shown in the timing chart of Figs. 9A and 9B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey10 and holding it in a register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

In the parameter setting, in addition to the encryption key 152 and the encryption / decryption selection signal 153, various parameters for encryption / decryption such as key length and encryption mode are set as necessary. The values of the encryption / decryption selection signal 153 and the encryption key 152 need to always be kept external until a new parameter is set. The parameter setting period is a period having an arbitrary length immediately after reset. When the key preparation start signal 155 is asserted from a unit external to the AES core 101 (T06), the parameter setting period ends.

At the same time as the end of the parameter setting period, the next key preparation period is started. In the key preparation period, the key expansion unit 102 advances the last round key in advance to simultaneously supply the two round keys wkey9 and wkey10 to the encryption / decryption unit 103 in the ninth cycle T26 of encryption / decryption. Create (wkey10). The key preparation period is a period until the timing after 11 cycles (T17) in which the last round key wkey10 is generated after the key preparation start signal 155 is asserted.

Next, the operation of each circuit during the key preparation period will be described. When the key preparation start signal 155 is asserted, the control unit 104 counts up the counter signal 161 in order from zero. The key expansion unit 102 expands wkey0 (encryption key 152) in each clock cycle in accordance with the counter signal 161 to generate ten round keys wkey1, wkey2, ..., wkeyl0. The generated round keys are output in turn as round key A 162.

At the timing T16, the counter signal 161 becomes "10". The key expansion unit 102 keeps the generated round key wkey10 in a register and outputs it as the round key B 163. Thereafter, wkey10 is maintained until the next key preparation execution.

At the end of the key preparation period (T17), the key expansion unit 102 outputs the round key (wkeyO in encryption, or wkey9 in decryption) used first for encryption / decryption as the round key A 162. The value of round key A 162 remains until the encryption / decryption start signal 158 is asserted. The controller 104 stops counting up the count signal 162 and clears the counter to zero.

Near the end of the key preparation period, key preparation will end at T17, and in anticipation of encryption being enabled, control unit 104 asserts control signal 157 at T16.

If it is detected at T17 that the control signal 157 is asserted, the input signal supply unit disposed outside the AES core 101 supplies the plain text data P0 to the AES core 101 as the input signal 150. The encryption / decryption start signal 158 is asserted to initiate encryption of the input signal 150 (T17). In the timing chart, the encryption / decryption start signal 158 is asserted in the shortest cycle. However, the timing is freely determined outside the AES core 101.

In the encryption period, the input signal 150 is encrypted. The encryption period is a period from when the encryption / decryption start signal 158 is asserted (T17) to a timing T27 10 cycles later.

Upon detecting that the encryption / decryption start signal 158 is asserted, the control unit 104 receives the control signal 157, the output holding signal 159, and the output holding control signal 160 in the next cycle T18. Gate. At the same time, the controller 104 starts to count up the counter signal 161.

The key expansion unit 102 performs key expansion sequentially from the round key wkeyO according to the counter signal 161. The key expansion unit 102 outputs wkey1 at T18, wkey2 at T19, ..., and wkey9 at T26 to the encryption / decryption unit 103 as the round key A 162.

From T17 to T18, the select signal 171 is negated. Therefore, the modified round function module 105 performs subblock conversion using wkey0 output as the round key A on the input signal 150. From T18 to T27, the selection signal 171 is asserted. Therefore, the modified round function module 105 performs subblock conversion on the output of the data holding unit 108 using wkey1 from T18 to T19, wkey2 from T19 to T20, ..., wkey8 from T25 to T26. do.

In a final cycle T26 of encryption, the control 104 asserts the selection signal 170. Therefore, the selector 115 of the modified round function module 105 selects the output of the AddRoundKey transformation module 114 that executes the AddRoundKey transformation using the round key B 163, and executes the subblock transformation of the last cycle. do. In T26, the output signal 166 of the modified round function module 105 outputs the ciphertext data C0 which is a result of the encryption of the plain text data P0 as an input signal. After one cycle (T27), the data holding unit 108 outputs the value of the ciphertext data C0 to the outside as the output of the AES core 101. At the same time, the control unit 104 asserts the valid signal 159 to notify that the unit outside the AES core 101 is encrypted and the output signal 151 is valid (T27). While the valid signal 159 is asserted, the AES core 101 ensures that the output signal 151 is valid.

On the other hand, although the valid signal 159 is asserted in T27, the output maintenance control signal 160 is maintained as a gate because the encryption / decryption start signal 158 is asserted in T27. If the encryption / decryption start signal 158 is not asserted at T27, the output hold control signal 160 is asserted at T27, and the value of the data retainer 108 holds the ciphertext data C0.

At T27 at which encryption ends, the key expansion unit 102 outputs wkey0 as the round key A 162. The value of round key A 162 is maintained until the next encryption / decryption start signal 156 is asserted.

In anticipation of the end of encryption (T27), the control unit 104 asserts the control signal 157 before the complete cycle (T26). When the control signal 157 is asserted, a unit outside the AES core 101 sets the value of the input signal 150 to the next plain text data P1 so that the encryption of the second block can start. do. 9A and 9B, the external unit of the AES core 101 asserts the next encryption / decryption start signal in the shortest cycle T27. The decoding operation of the second block is performed in the same manner as the first block. Thereafter, the encryption operation is repeatedly performed for a predetermined number of blocks. In the timing charts of Figs. 9A and 9B, encryption of the second block is started at the shortest interval from the encryption end of the first block. The AES core can achieve maximum performance by executing encryption of all blocks at this timing. However, the encryption interval can basically be set to any length.

When the encryption of the predetermined number of blocks is completely terminated and the next operation is to be performed using another parameter such as an encryption key, the process starts again from the parameter setting.

Next, the decoding operation of this embodiment will be described. 10A and 10B are a timing chart of decoding according to the present embodiment. 10A and 10B, the horizontal axis represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis of the left end of FIG. 10A represent signal lines and correspond one-to-one with reference numbers of the signal lines used in FIGS. 5 to 8.

The decryption operation is also roughly divided into four parts: parameter setting periods T01 to T06, key preparation periods T06 to T17, first block decryption periods T17 to T27, and second block decryption periods after T27.

The parameter setting period is from T01 to T06, and its role, start condition, and end condition are the same as in encryption of the present embodiment. However, the encryption / decryption selection signal 153 is asserted at the time of decryption.

The key preparation period is from T06 to T17, and the start condition and end condition are the same as in encryption of this embodiment. The operation of each circuit is also almost the same as in the encryption of this embodiment. However, the round key used in the first cycle is different between encryption and decryption. Therefore, the key expansion unit 102 performs key expansion in reverse order from wkey10 at the end of the key preparation period T17 to generate wkey9, and outputs this key as the round key A 162. The value of round key A 162 is maintained until encryption / decryption start signal 158 is asserted. The control unit 104 stops counting up the counter signal 161 and clears the counter to zero.

Near the end of the key preparation period, the control unit 104 asserts the control signal 157 at T16 in anticipation of the key preparation being completed at T17 and enabling decryption.

When the control signal 157 is detected at T17, the input signal supply unit disposed outside the AES core 101 supplies the plain text data C0 as the input signal 150 to the AES core 101. . The encryption / decryption start signal 158 is asserted to start decrypting the input signal 150 (T17). In the timing chart, the encryption / decryption start signal 158 is asserted in the shortest cycle. However, the timing is freely determined outside the AES core 101.

In the decoding period, the input signal 150 is decoded. The decryption period is a period from when the encryption / decryption start signal 158 is asserted (T17) to a timing T27 10 cycles later.

Upon detecting that the encryption / decryption start signal 158 is asserted, the controller 104 negates the control signal 157, the valid signal 159, and the output retention control signal 160 in the next cycle T18. do. At the same time, the controller 104 starts to count up the counter signal 161.

The key expansion unit 102 performs key expansion in the reverse order from the round key wkey9 in accordance with the counter signal 161. The key expansion unit 102 outputs wkey9 at T18, wkey8 at T19, ..., and wkeyO at T26 to the encryption / decryption unit 103 as the round key A 162.

From T17 to T18, the selection signal 171 is negated. Thus, the modified round function module 106 performs subblock conversion on the input signal 150 using wkey9 output as round key A. In the first cycle of decoding, the control unit 104 asserts the selection signal 170. Accordingly, the selector 118 of the modified round function module 106 selects the output of the AddRoundKey transformation module 117 that executes the AddRoundKey transformation using the round key B 163 to perform the subblock transformation of the first cycle. Run

From T18 to T27, the selection signal 171 is asserted. Accordingly, the modified round function module 106 performs subblock conversion on the output of the data holding unit 108 using wkey8 from T18 to T19, wkey7 from T19 to T20, ..., and wkeyO from T25 to T26. do.

In T26, the output signal 167 of the modified round function module 106 outputs the plain text data P0 which is the result of decryption of the cipher text data C0 as the input signal. After one cycle (T27), the data holding unit 108 outputs the value of the plain text data P0 to the outside as the output of the AES core 101. At the same time, the control unit 104 asserts the valid signal 159 to notify the external unit of the AES core 101 that decryption is completed and the output signal 151 is valid (T27). While the valid signal 159 is asserted, the AES core 101 ensures that the output signal is valid.

On the other hand, the valid signal 159 is asserted at T27, but since the encryption / decryption start signal 158 is also asserted at T27, the output holding control signal 160 remains negated. If the encryption / decryption start signal 158 is not asserted at T27, the output holding control signal 160 is asserted at T27, so that the value of the data holding unit 108 holds the plain text data P0.

At the end of decryption at T27, the key expansion unit 102 obtains wkey9 from wkey10 as the inverse, and outputs it as the round key A 162. The value of round key A 162 is maintained until the next encryption / decryption start signal 156 is asserted.

In anticipation of the end of the decoding (T27), the control unit 104 asserts the control signal 157 before the end of the cycle (T26). When the control signal 157 is asserted, a unit outside the AES core 101 sets the value of the input signal 150 to the next ciphertext data C1 so that decryption of the second block can be started. 10A and 10B, the unit outside the AES core 101 asserts the next encryption / decryption start signal 158 in the shortest cycle T27. The decoding operation of the second block is performed in the same manner as the first block. After that, the decryption operation is repeatedly performed any number of times.

When the decryption is completely finished and the next work must be started, the process starts again from the parameter setting.

The first embodiment can be implemented in this way. In the first embodiment, the number of clock cycles required for AES encryption is reduced by one cycle without increasing the maximum value of the sum of the signal processing times for each subblock conversion within each clock cycle period. This increases the AES processing speed by about 10%.

Second Embodiment

11 is a diagram showing the processing contents of encryption and decryption executed in clock cycles according to the second embodiment.

Referring to Fig. 11, the cycle count indicates a clock cycle count that is "0" at the start of AES processing.

In the encryption processing of the present embodiment, in the 0th cycle, the first AddRoundKey conversion, ShiftRows conversion, SubBytes conversion, MixColumns conversion, and the second AddRoundKey conversion are executed. In the first to eighth cycles, AddRoundKey transformation, ShiftRows transformation, SubBytes transformation, and MixColumns transformation are executed. In the ninth cycle, AddRoundKey transformation, ShiftRows transformation, and SubBytes transformation are performed. As the round key, wkeyO and wkey1 in the 0th cycle, wkey2 in the first cycle, ..., and wkeyl0 in the ninth cycle are used.

In the second embodiment, the same processing as in the prior art is executed as a whole. However, in this embodiment, AES encryption can be executed in clock cycles fewer by one.

Next, the sum of the signal processing time for each subblock transformation executed in clock cycles according to the second embodiment will be described. FIG. 12 is a diagram showing a comparison between the sum of the signal processing time and each prior art for each subblock transformation executed in clock cycles in the second embodiment. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement the second embodiment, the maximum value of the sum of the signal processing times for each subblock transform must be smaller than one cycle time. As shown in FIG. 12, the processing time of each subblock transform is the longest in the SubBytes transform, and is short in the order of the MixColumns transform, the AddRoundKey transform, and the ShiftRows transform.

In the present embodiment, the sum of the signal processing time for each subblock transformation in the 0th cycle in which the first AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, MixColumns transformation, and the second AddRoundKey transformation are performed is the AddRoundKey transformation, SubBytes transformation. , The sum of the signal processing time for each subblock transform in the first to eighth cycles where the ShiftRows transform, and the MixColumns transform are performed, or each subblock transform in the ninth cycle where the AddRoundKey transform, SubBytes transform, and ShiftRows transform are performed. Is longer than the sum of the signal processing times for. Therefore, the maximum value of the sum of the signal processing time for each subblock transform of this embodiment is larger than the prior art by corresponding to the processing time of one AddRoundKey transform. However, the processing time of one AddRoundKey transformation is much shorter than the sum of the signal processing times for each subblock transformation within one cycle. The maximum sum of the signal processing time for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. For this reason, it is assumed that this embodiment is also feasible in many cases if the maximum value of the sum of the decoding processing times for each subblock transformation within each clock cycle period of the prior art is shorter than one cycle time.

The present invention is also applicable to AES decryption.

As shown in Fig. 11, in the decoding of the present embodiment, AddRoundKey transformation, InvShiftRows transformation, and InvSubBytes transformation are executed in the 0th cycle. In the first to eighth cycles, AddRoundKey conversion, InvShiftRows conversion, InvSubBytes conversion, and InvMixColumns conversion are executed. In the ninth cycle, the first AddRoundKey transformation, the InvShiftRows transformation, the InvSubBytes transformation, the InvMixColumns transformation, and the second AddRoundKey transformation are executed. As the round key, wkey10 is used in the 0th cycle, wkey9 is used in the 1st cycle, and wkey2 is used in the 8th cycle. In the ninth cycle, two round keys wkey1 and wkey0 are used.

In the second embodiment, the same processing as in the prior art is executed as a whole. However, in the second embodiment, AES decryption can be executed in clock cycles fewer by one.

Next, the sum of the signal processing time for each subblock transformation executed in clock cycles according to the second embodiment will be described. FIG. 13 is a diagram showing a comparison between the sum of the signal processing time for each subblock conversion executed in clock cycles and the prior art in the second embodiment. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement this embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period should be less than one cycle time. As shown in Fig. 13, the processing time of each subblock transform is the longest in the InvSubBytes transform, and shortens in the order of the InvMixColumns transform, the AddRoundKey transform, and the InvShiftRows transform.

In the second embodiment, the sum of the signal processing times for each subblock transform in the ninth cycle in which the first AddRoundKey transform, InvSubBytes transform, InvShiftRows transform, InvMixColumns transform, and second AddRoundKey transform are performed is performed by AddRoundKey transform, InvSubBytes. Sum of signal processing time for each subblock transform in the first to eighth cycles where the transform, InvShiftRows transform, and InvMixColumns transform are performed, or each subblock in the zeroth cycle where the AddRoundKey transform, InvSubBytes transform, and InvShiftRows transform are performed Longer than the sum of the signal processing times for the transforms. Therefore, the maximum value of the sum of the signal processing time for each subblock transform of the second embodiment is larger than the prior art by corresponding to the processing time of one AddRoundKey transform. However, the processing time of one AddRoundKey transformation is much shorter than the sum of the signal processing times for each subblock transformation within one cycle. The maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. For this reason, it is assumed that the present embodiment can also be implemented in most cases if the maximum value of the sum of the decoding processing times for each subblock transformation within each clock cycle period of the prior art is shorter than one cycle time.

The features of the second embodiment are summarized.

In a conventional general implementation method, the round function defined by the specification is regarded as a break in processing, so that encryption and decryption are distributed among clock cycles. Therefore, the sum of the signal processing times for each subblock transform in the 10th and 0th cycles is shorter than the sum of the decoding process times for each subblock transform in each of the 1st to 9th cycles. That is, the sum of the signal processing times for each subblock transform executed in each cycle varies.

On the other hand, in the present invention, the signal processing in some clock cycles is increased so that the difference in the sum of the signal processing times for each subblock conversion within each clock cycle period is reduced.

In this embodiment, the maximum value of the sum of the signal processing times for each subblock transform executed in one cycle is slightly increased. Thus, the present embodiment need not necessarily be implemented under the conditions in which the prior art can be implemented. However, since the maximum value of the sum of signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time, this is not a problem in most cases. In most cases, the number of clock cycles required for AES encryption or decryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

Next, a circuit configuration of the AES core for implementing AES encryption and decryption will be described.

14 is a block diagram of an AES core according to the present embodiment.

Referring to FIG. 14, the AES Core 131 executes AES processing. The key expansion unit 132 generates a round key for AES encryption and decryption from the encryption key and outputs the round key. The encryption / decryption unit 133 performs encryption of 128-bit plain text data or decryption of 128-bit cipher text data using the round key supplied from the key expansion unit 132. The control unit 134 receives a control signal from a unit external to the AES core 131, and controls the operations of the key expansion unit 132 and the encryption / decryption unit 133 and completes the operation of the AES core 131. ) Generates a signal for notifying the external unit.

Referring to FIG. 14, the selection signal 175 is output from the control unit 134 to the encryption / decryption unit 133 in order to switch the connection of the subblock transformation in the encryption / decryption unit 133.

The components and signal lines in FIG. 14 are the same as those described in the first embodiment, and description thereof is omitted.

Next, the encryption / decryption unit 133 will be described. 15 is a block diagram for explaining the encryption / decryption unit 133. Referring to FIG. 15, the modified round function module 135 performs one cycle of encryption using the round key A 162 and the round key B 163 under the control of the select signal 170 and the select signal 175. Run The modified round function module 136 performs decryption using the round key A 162 and the round key B 163 under the control of the selection signals 170 and 175.

In the above configuration, when the selection signal 171 is negated, the selector 109 of the encryption / decryption section 133 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108.

The components and signal lines in Fig. 15 are the same as those described in the first embodiment, and the description thereof is omitted.

Next, the modified round function module 135 will be described. 16 is a block diagram of a modified round function module 135. Referring to FIG. 16, the AddRoundKey conversion module 114 receives an input signal 165 and a round key B 163 and performs AddRoundKey conversion. The selector 137 selects and outputs one of the input signal 165 and the output of the AddRoundKey conversion module 114 according to the selection signal 175. The SubBytes conversion module 111 receives the output of the selector 137 and performs SubBytes conversion. The ShiftRows conversion module 112 receives the output of the SubBytes conversion module 111 and executes ShiftRows conversion. The MixColumns conversion module 113 receives the output of the ShiftRows conversion module 112 and executes MixColumns conversion. The selector 115 selects and outputs one of the output of the MixColumns conversion module 113 and the output of the ShiftRows conversion module 112 according to the selection signal 170. The AddRoundKey conversion module 110 receives the output of the selector 115 and the round key A 162 to execute AddRoundKey conversion. The output signal of the AddRoundKey conversion module 110 is the output signal of the modified round function module 135.

In the above configuration, when the selection signal 170 is negated, the selector 115 selects and outputs the output of the MixColumns conversion module 113. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the ShiftRows transform module 112. When select signal 175 is negated, selector 137 selects and outputs input signal 165. When the selection signal 175 is asserted, the selector 137 selects and outputs the output of the AddRoundKey conversion module 114.

Next, the modified round function module 136 will be described. 17 is a block diagram of a modified round function module 136. Referring to FIG. 17, the AddRoundKey conversion module 121 receives an input signal 165 and a round key A 162 and performs AddRoundKey conversion. The InvMixColumns conversion module 116 receives the output of the AddRoundKey conversion module 121 and performs InvMixColumns conversion. The selector 118 selects and outputs one of an output of the InvMixColumns conversion module 116 and an output of the AddRoundKey conversion module 121 according to the selection signal 170. The InvShiftRows transformation module 119 receives the output of the selector 118 and executes InvShiftRows transformation. The InvSubBytes conversion module 120 receives the output of the InvShiftRow conversion module 119 and performs InvSubBytes conversion. The AddRoundKey conversion module 117 receives the output of the InvSubBytes conversion module 120 and the round key B 163 and executes AddRoundKey conversion. The selector 138 selects and outputs one of the output of the InvSubBytes conversion module 120 and the output of the AddRoundKey conversion module 117 according to the selection signal 175. The output of the selector 138 is the output of the modified round function module 136.

In the above configuration, when the selection signal 170 is negated, the selector 118 selects and outputs the output of the InvMixColumns conversion module 116. When the selection signal 170 is asserted, the selector 118 selects and outputs the output of the AddRoundKey conversion module 121. When the selection signal 175 is negated, the selector 138 selects and outputs the output of the InvSubBytes conversion module 120. When the selection signal 175 is asserted, the selector 138 selects and outputs the output of the AddRoundKey conversion module 117.

Next, the encryption operation in the above configuration will be described. 18A and 18B are a timing chart of encryption according to the second embodiment. 18A and 18B, the horizontal axis represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis at the left end of FIG. 18A represent signal lines and correspond one-to-one with reference numerals of the signal lines used in FIGS. 14 to 17.

The encryption operation shown in the timing chart of Figs. 18A and 18B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in the first embodiment. The key preparation period is from T06 to T17, and the start condition and end condition are the same as in the first embodiment. The operation of each circuit is also the same as in the first embodiment. However, the operation of the key expansion unit 132 at the timing T16 and the operation of the key expansion unit 132 and the control unit 134 at the timing T17 are different from those in the first embodiment, and will be described below.

At the timing T16, the key expansion unit 132 outputs wkey0 as the round key B 163. The round key wkey10 is held in a register provided in the key expansion unit 132.

At timing T17, the key expansion unit 132 outputs wkey1 as the round key A 162. The controller 134 asserts the selection signal 175.

The first block encryption period is from T17 to T27, and the start condition and end condition are the same as in the first embodiment. The operation of each circuit is also almost the same as in the first embodiment.

The control unit 134 asserts the selection signal 175 at the end of encryption and negates it in the first cycle of encryption (T18 or T28). The control unit 134 also asserts the selection signal 170 in the final cycle of encryption T16 and negates it at the end of encryption (T17). The control unit 134 also asserts the selection signal 171 in the first cycle of encryption and negates it at the end of encryption.

As described with respect to the circuit configuration, when the select signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When select signal 170 is negated, selector 115 selects and outputs the output of MixColumns transform module 113. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 112. When select signal 175 is negated, selector 137 selects and outputs input signal 165. When the selection signal 175 is asserted, the selector 137 selects and outputs the output of the AddRoundKey conversion module 114.

Accordingly, in the 0 th cycle T17 to T18, the modified round function module 135 performs AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing SubBytes transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation on the result of the previous cycle. In the ninth cycle (T26 to T27), the modified round function module outputs the result obtained by executing the SubBytes transformation, the ShiftRows transformation, and the AddRoundKey transformation.

By controlling the selection signals 171, 170, and 175 in the manner described above, the modified round function module 135 can execute encryption as shown in FIG. 11.

On the other hand, the key expansion unit 132 outputs wkey1 as the round key A 162 and wkey0 as the round key B 163 after the key preparation period. Therefore, wkey0 and wkey1 are supplied to the modified round function module 135 at the start of encryption (T17). Upon detecting the start of encryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 132 generates wkey2 using wkey1 held in the round key A register, and wkey2 in the round key A register. Keep it. Thus, wkey2 is supplied to the modified round function module 135 at T18. Round keys are supplied in the same way up to T26. When wkey10 is maintained in the round key A register, and the round key supply is terminated at T26, the key expansion unit 132 generates wkey1 using wkey0 continuously supplied to the outside as the encryption key 152, and the round key A register Wkey1 is held in preparation for preparation of the next encryption start (T27).

As described above, when the key extension 132 operates, the modified round function module 135 may use the round key in each cycle as shown in FIG.

The operation during the encryption period according to the second embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the encryption operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 18A and 18B, the encryption of the second block is started at the shortest interval after the termination of the encryption of the first block. The AES core can achieve its maximum performance by executing encryption of all blocks at this timing. However, the encryption interval can basically be set to any length.

When the encryption of the predetermined number of blocks is completely terminated and the next operation is to be performed using another parameter such as an encryption key, the process starts again from the parameter setting.

Next, the decoding operation of this embodiment will be described. 19A and 19B are timing charts of decoding according to the present embodiment. 19A and 19B, the horizontal axis represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis of the left end of FIG. 19A represent signal lines and correspond one-to-one with reference numerals of the signal lines used in FIGS. 14 to 17.

The decoding operation shown in the timing chart of Figs. 19A and 19B is also roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is the key preparation period (T06 to T17) that generates wkey0 and holds it in the register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in the first embodiment. The key preparation period is from T06 to T17, and the start condition and end condition are the same as in the first embodiment. The operation of each circuit is also the same as in the first embodiment. However, operations of the key expansion unit at timing T16 and operations of the key expansion unit 132 and the control unit 134 at timing T17 are different from those in the first embodiment, and will be described below.

At the timing T16, the key expansion unit 132 outputs wkey0 as the round key B 163. The round key wkey0 is held in a register provided in the key expansion unit 132.

At timing T17, the key expansion unit 132 outputs wkey10 as the round key A 162. The controller 134 asserts the selection signal 170.

The encryption period of the first block is from T17 to T27, and its start condition and end condition are the same as in the first embodiment. The operation of each circuit is also almost the same as in the first embodiment.

The control unit 134 asserts the selection signal 170 at the end of decoding and negates it in the first cycle of decoding (T18 or T28). The control unit 134 also asserts the selection signal 175 in the final cycle T16 of decoding and negates it at the end of decoding (T17). The control unit 134 also asserts the selection signal 171 in the first cycle of decoding and negates it at the end of decoding.

As described with respect to the circuit configuration, when the select signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When select signal 170 is negated, selector 118 selects and outputs the output of InvMixColumns transform module 116. When the selection signal 170 is asserted, the selector 118 selects and outputs the output of the AddRoundKey conversion module 121. When the selection signal 175 is negated, the selector 138 selects and outputs the output of the InvSubBytes conversion module 120. When the selection signal 175 is asserted, the selector 138 selects and outputs the output of the AddRoundKey conversion module 117.

Thus, in the 0 th cycle T17 to T18, the modified round function module 136 performs AddRoundKey transformation, InvShiftRows transformation, and InvSubBytes transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing AddRoundKey transformation, MixColumns transformation, InvShiftRows transformation, and InvSubBytes transformation on the result of the previous cycle. In the ninth cycle (T26 to T27), the modified round function module outputs the result obtained by executing AddRoundKey transformation, InvMixColumns transformation, InvShiftRows transformation, InvSubBytes transformation, and AddRoundKey transformation.

By controlling the selection signals 171, 170, and 175 in the above-described manner, the modified round function module 136 can execute decoding as shown in FIG. 11.

On the other hand, the key expansion unit 132 outputs wkey10 as the round key A 162 and wkey0 as the round key B 163 after the key preparation period. Therefore, wkey10 is supplied to the modified round function module 136 at the start of decryption (T17). Upon detecting the start of decryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 132 generates wkey9 using wkey10 held in the round key A register, and wkey9 in the round key A register. Keep it. Thus, wkey9 is supplied to the modified round function module 136 at T18. Round keys are supplied in the same way up to T26. When wkey1 is held in the round key A register, and the round key supply is terminated at T26 (T26), the key expansion unit 132 loads wkey10 held in the internal register of the key expansion unit into the round key A register to perform the next decryption. Prepare for the start T27.

As described above, when the key extension 132 is operated, the modified round function module 136 may use the round key in each cycle as shown in FIG.

The operation during the decoding period according to the second embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the decoding operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 19A and 19B, decoding of the second block is started at the shortest interval after completion of decoding of the first block. The AES core can achieve its maximum performance by executing decryption of all blocks at this timing. However, the decryption interval can basically be set to any length.

When the decryption of the predetermined number of blocks is completely finished and the next operation is to be performed using another parameter such as an encryption key, the process starts again from the parameter setting.

The second embodiment can be implemented in the above way. In the second embodiment, the maximum value of the sum of the signal processing times for each subblock transform that must be executed in one cycle increases somewhat. However, since the maximum value of the sum of signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time, this is not a problem in most cases. Thus, in most cases, the number of clock cycles required for AES encryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

The above 2nd Example is only an example of this invention to the last, The effect of this invention is not limited to the said Example.

Third Embodiment

20 is a diagram showing the processing contents of encryption and decryption executed in each clock cycle according to the third embodiment. Referring to Fig. 20, the cycle count indicates a clock cycle count that is "0" at the start of AES processing.

In the encryption processing of the third embodiment, AddRoundKey conversion, ShiftRows conversion, and SubBytes conversion are executed in the 0th cycle. In the first to eighth cycles, AddRoundKey transformation, ShiftRows transformation, SubBytes transformation, and MixColumns transformation are executed. In the ninth cycle, MixColumns transformation, first AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, and second AddRoundKey transformation are performed. As the round key, wkeyO is used in the 0th cycle, wkey1 in the 1st cycle, ..., and wkey8 in the 8th cycle. In the ninth cycle, two round keys wkey9 and wkey10 are used.

In the third embodiment, the same processing as in the prior art is executed as a whole. However, in the third embodiment, AES encryption can be executed in clock cycles fewer by one.

Next, the sum of the signal processing time for each subblock conversion executed in clock cycles according to the third embodiment will be described. FIG. 21 is a diagram showing a comparison between the sum of the encryption processing times for each subblock transformation in each clock cycle period and the prior art in the third embodiment. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement the third embodiment, the maximum of the sum of the signal processing times for each subblock transformation within each clock cycle period must be less than one cycle time. As shown in Fig. 21, the processing time of each subblock transform is the longest in the SubBytes transform, and is short in the order of the MixColumns transform, the AddRoundKey transform, and the ShiftRows transform.

In the third embodiment, the sum of the signal processing times for each subblock transform in the ninth cycle in which the AddRoundKey transform, SubBytes transform, ShiftRows transform, MixColumns transform, and the second AddRoundKey transform is performed is the AddRoundKey transform, SubBytes transform. , The sum of the signal processing time for each subblock transform in the first to eighth cycles where the ShiftRows transform, and the MixColumns transform are performed, or each subblock transform in the 0th cycle where the AddRoundKey, SubBytes, and ShiftRows transforms are performed. Is longer than the sum of the signal processing times for. Therefore, the maximum value of the sum of the signal processing times for each subblock transform of the third embodiment is larger than the prior art by corresponding to the processing time of one AddRoundKey transform. However, the processing time of one AddRoundKey transformation is much shorter than the sum of the signal processing times for each subblock transformation within one cycle. The maximum sum of the signal processing time for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. Accordingly, it is assumed that this embodiment is also feasible in many cases if the maximum value of the sum of the decoding processing times for each subblock transformation within each clock cycle period of the prior art is shorter than one cycle time.

The present invention is also applicable to AES decryption.

As shown in Fig. 20, in the decryption of the third embodiment, the first AddRoundKey transformation, the InvShiftRows transformation, the InvSubBytes transformation, the InvMixColumns transformation, and the second AddRoundKey transformation are executed in the zeroth cycle. In the first to eighth cycles, AddRoundKey conversion, InvShiftRows conversion, InvSubBytes conversion, and InvMixColumns conversion are executed. In the ninth cycle, the AddRoundKey transformation, InvShiftRows transformation, and InvSubBytes transformation are executed. As the round key, wkey10 and wkey9 in the 0th cycle, wkey8 in the 1st cycle, ..., and wkey0 in the 9th cycle are used.

In the third embodiment, the same processing as in the prior art is executed as a whole. However, in the third embodiment, AES decryption can be executed in clock cycles fewer by one.

Next, the sum of the signal processing time for each subblock conversion executed in clock cycles according to the third embodiment will be described. FIG. 22 is a diagram showing a comparison between the sum of the signal processing time for each subblock conversion executed in clock cycles and the prior art in the third embodiment. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement this embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period should be less than one cycle time. As shown in Fig. 22, the processing time of each subblock transform is the longest in the InvSubBytes transform, and shortens in the order of the InvMixColumns transform, the AddRoundKey transform, and the InvShiftRows transform.

In the third embodiment, the sum of the signal processing times for each subblock transform in the 0th cycle in which the first AddRoundKey transform, InvSubBytes transform, InvShiftRows transform, InvMixColumns transform, and the second AddRoundKey transform is executed is the AddRoundKey transform, InvSubBytes Summing of signal processing time for each subblock transform in the first to eighth cycles where the transform, InvShiftRows transform, and InvMixColumns transform are performed, or each cycle in the ninth cycle where the AddRoundKey transform, InvSubBytes transform, and InvShiftRows transform are performed. It is longer than the sum of the signal processing times for the subblock transformations. Therefore, the maximum value of the sum of the signal processing time for each subblock transformation of the third embodiment is larger than the prior art by corresponding to the processing time of one AddRoundKey transformation. However, the processing time of one AddRoundKey transformation is much shorter than the sum of the signal processing times for each subblock transformation in one cycle. The maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. Therefore, it is assumed that the present embodiment can also be implemented in most cases if the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period of the prior art is shorter than one cycle time.

The features of the third embodiment are summarized.

In a conventional general implementation method, the round function defined by the specification is regarded as a break in processing, so that encryption and decryption are distributed among clock cycles. Therefore, the sum of the signal processing times for each subblock transform in the 10th and 0th cycles is shorter than the sum of the signal processing times for each subblock transform in each of the 1st to 9th cycles. That is, the sum of the signal processing times for each subblock transform executed in each cycle is varied.

On the other hand, in the third embodiment, the signal processing in some clock cycles is increased so that the difference in the sum of the signal processing times for each subblock conversion within each clock cycle period is reduced.

In the third embodiment, the maximum of the sum of the signal processing times for each subblock transform executed in one cycle is somewhat increased. Thus, the present embodiment need not necessarily be implemented under the conditions in which the prior art can be implemented. However, since the maximum value of the sum of signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time, this is not a problem in most cases. In most cases, the number of clock cycles required for AES encryption or decryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

Next, a circuit configuration of the AES core for implementing AES encryption and decryption will be described. 23 is a block diagram of an AES core according to the present embodiment. Referring to Fig. 23, the AES Core 141 executes AES processing. The key expansion unit 142 generates a round key for AES encryption and decryption from the encryption key and outputs the round key. The encryption / decryption unit 143 performs encryption of the 128-bit plain text data or decryption of the 128-bit cipher text data using the round key supplied from the key expansion unit 142. The control unit 144 receives a control signal from a unit external to the AES core 141 to control the operations of the key expansion unit 142 and the encryption / decryption unit 143 and completes the operation of the AES core 141. ) Generates a signal for notifying the external unit.

Since the components and signal lines of FIG. 23 are the same as those described in the first and second embodiments, description thereof is omitted.

Next, the encryption / decryption unit 143 will be described. 24 is a block diagram for explaining the encryption / decryption unit 143. Referring to FIG. 24, the modified round function module 145 executes one cycle of encryption using the round key A 162 and the round key B 163 under the control of the selection signals 170 and 175. The modified round function module 146 performs decryption using the round key A 162 and the round key B 163 under the control of the selection signals 170 and 175.

In the above configuration, when the selection signal 171 is negated, the selector 109 of the encryption / decryption section 143 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108.

The components and signal lines in FIG. 24 are the same as those described in the first embodiment, and description thereof is omitted.

Next, the modified round function module 145 will be described. 25 is a block diagram of a modified round function module 145. Referring to FIG. 25, the MixColumns conversion module 113 receives an input signal 165 and performs MixColumns conversion. The selector 137 selects and outputs one of the input signal 165 and the output of the MixColumns conversion module 113 according to the selection signal 175. The AddRoundKey conversion module 110 receives the output of the selector 137 and the round key A 162 to perform AddRoundKey conversion. The SubBytes conversion module 111 receives the output of the AddRoundKey conversion module 110 and performs SubBytes conversion. The ShiftRows conversion module 112 receives the output of the SubBytes conversion module 111 and executes ShiftRows conversion. The AddRoundKey conversion module 114 receives the output of the ShiftRows conversion module 112 and the round key B 163 to execute AddRoundKey conversion. The selector 115 selects and outputs one of an output of the ShiftRows conversion module 112 and an output of the AddRoundKey conversion module 114 according to the selection signal 170. The output signal of the selector 115 is the output signal of the modified round function module 145.

In the above configuration, when the selection signal 170 is negated, the selector 115 selects and outputs the output of the ShiftRows conversion module 112. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114. When select signal 175 is negated, selector 137 selects and outputs the output of MixColumns transform module 113. When select signal 175 is asserted, selector 137 selects and outputs input signal 165.

Next, the modified round function module 146 will be described. 26 is a block diagram of a modified round function module 146. Referring to FIG. 26, the AddRoundKey conversion module 121 receives an input signal 165 and a round key A 162 and performs AddRoundKey conversion. The selector 118 selects and outputs one of the input signal 165 and the output of the AddRoundKey conversion module 121 according to the selection signal 170. The InvShiftRows transformation module 119 receives the output of the selector 118 and executes InvShiftRows transformation. The InvSubBytes conversion module 120 receives the result of the InvShiftRows conversion module 119 and executes InvSubBytes conversion. The AddRoundKey conversion module 117 receives the output of the InvSubBytes conversion module 120 and the round key B 163 and executes AddRoundKey conversion. InvMixColumns conversion module 116 receives the output of AddRoundKey conversion module 117 and executes InvMixColumns conversion. The selector 138 selects and outputs one of the output of the InvMixColumns conversion module 116 and the output of the AddRoundKey conversion module 117 according to the selection signal 175. The output of the selector 138 is the output of the modified round function module 146.

In the above configuration, when the select signal 170 is negated, the selector 118 selects and outputs the input signal 165. When the selection signal 170 is asserted, the selector 118 selects and outputs the output of the AddRoundKey conversion module 121. When select signal 175 is negated, selector 138 selects and outputs the output of InvMixColumns transform module 116. When the selection signal 175 is asserted, the selector 138 selects and outputs the output of the AddRoundKey conversion module 117.

Next, the encryption operation in the above configuration will be described. 27A and 27B are a timing chart of encryption according to the second embodiment. Referring to Figs. 27A and 27B, the horizontal axis represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis of the left end of FIG. 27A represent signal lines and correspond one-to-one with reference numbers of the signal lines used in FIGS. 23 to 26.

The encryption operation shown in the timing chart of Figs. 27A and 27B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in the first embodiment. The key preparation period is from T06 to T17, and the start condition and end condition are the same as in the first embodiment. The operation of each circuit is also the same as in the first embodiment. However, the controller 144 asserts the selection signal 175 at the end of the key preparation period T17.

The encryption period of the first block is from T17 to T27, and its start condition and end condition are the same as in the first embodiment. The operation of each circuit is also almost the same as in the first embodiment.

The control unit 144 asserts the selection signal 175 at the end of encryption and negates it in the first cycle of encryption (T18 or T28). The control unit 144 also asserts the selection signal 170 in the final cycle of encryption T16 and negates it at the end of encryption (T17). The control unit 144 also asserts the selection signal 171 in the first cycle of encryption and negates it at the end of encryption.

As described with respect to the circuit configuration, when the selection signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When the selection signal 170 is negated, the selector 115 selects and outputs the output of the ShiftRows conversion module 112. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114. When select signal 175 is negated, selector 137 selects and outputs the output of MixColumns transform module 113. When the selection signal 175 is asserted, the selector 137 selects and outputs an input signal 165.

Thus, in the 0 th cycle T17 to T18, the modified round function module 145 performs AddRoundKey transformation, SubBytes transformation, and ShiftRows transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing SubBytes transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation on the result of the previous cycle. In the ninth cycle (T26 to T27), the modified round function module outputs the result obtained by executing the MixColumns transformation, AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, and AddRoundKey transformation.

By controlling the selection signals 171, 170, and 175 in the manner described above, the modified round function module 145 can execute encryption as shown in FIG. 20.

On the other hand, the key expansion unit 142 outputs wkey0 as the round key A 162 and wkey10 as the round key B 163 after the key preparation period. Therefore, wkey0 is supplied to the modified round function module 145 at the start of encryption (T17). Upon detecting the start of encryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 142 generates wkey1 using wkey0 held in the round key A register, and wkey1 in the round key A register. Keep it. Therefore, wkey1 is supplied to the modified round function module 145 at the timing T18. Round keys are supplied in the same way up to T26. In T26, wkey10 is also supplied as the round key B 163. When wkey10 is maintained in the round key A register, and the round key supply is terminated at T26, the key expansion unit 142 keeps wkey0 continuously supplied to the outside as the encryption key 152 in the round key A register, so that Prepare for start (T27).

As described above, when the key extension 142 operates, the modified round function module 145 may use the round key in each cycle as shown in FIG. 20.

The operation during the encryption period according to the third embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the encryption operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 27A and 27B, encryption of the second block is started at the shortest interval after termination of encryption of the first block. The AES core can achieve its maximum performance by executing encryption of all blocks at this timing. However, the encryption interval can basically be set to any length.

When the encryption of the predetermined number of blocks is completely terminated and the next operation is to be performed using another parameter such as an encryption key, the process starts again from the parameter setting.

Next, the decoding operation of this embodiment will be described. 28A and 28B are timing charts of decoding according to the present embodiment. 28A and 28B, the abscissa represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis of the left end of FIG. 28A represent signal lines and correspond one-to-one with reference numbers of the signal lines used in FIGS. 23 to 26.

The decoding operation shown in the timing chart of Figs. 28A and 28B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in the first embodiment. The key preparation period is from T06 to T17, and the start condition and end condition are the same as in the first embodiment. The operation of each circuit is also the same as in the first embodiment. However, the control unit 144 asserts the selection signal 170 at the end of the key preparation period (T17).

The encryption period of the first block is from T17 to T27, and its start condition and end condition are the same as in the first embodiment. The operation of each circuit is also almost the same as in the first embodiment.

The control unit 144 asserts the selection signal 170 at the end of decoding and negates it in the first cycle of decoding (T18 or T28). The control unit 144 also asserts the selection signal 175 in the final cycle T16 of decoding and negates it at the end of decoding (T17). The control unit 144 also asserts the selection signal 171 in the first cycle of decoding and negates it at the end of decoding.

As described with respect to the circuit configuration, when the select signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When select signal 170 is negated, selector 118 selects and outputs input signal 165. When the selection signal 170 is asserted, the selector 118 selects and outputs the output of the AddRoundKey conversion module 121. When select signal 175 is negated, selector 138 selects and outputs the output of InvMixColumns transform module 116. When the selection signal 175 is asserted, the selector 138 selects and outputs the output of the AddRoundKey conversion module 117.

Therefore, in the 0 th cycle T17 to T18, the modified round function module 146 performs AddRoundKey transformation, InvShiftRows transformation, InvSubBytes transformation, AddRoundKey transformation, and InvMixColumns transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing InvShiftRows transformation, InvSubBytes transformation, AddRoundKey transformation, and InvMixColumns transformation on the result of the previous cycle. In the ninth cycle T26 to T27, the modified round function module outputs the result obtained by executing the InvShiftRows transformation, the InvSubBytes transformation, and the AddRoundKey transformation.

By controlling the selection signals 171, 170, and 175 in the above-described manner, the modified round function module 146 can perform decryption as shown in FIG. 20.

On the other hand, the key expansion unit 142 outputs wkey9 as the round key A 162 and wkey10 as the round key B 163 after the key preparation period. Therefore, wkey10 and wkey9 are supplied to the modified round function module 146 at the start of decryption (T17). Upon detecting the start of decryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 142 generates wkey8 using wkey9 held in the round key A register, and wkey8 in the round key A register. Keep it. Thus, wkey8 is supplied to the modified round function module 146 at T18. Round keys are supplied in the same way up to T26. When wkey0 is held in the round key A register and the round key supply is terminated at T26 (T26), the key expansion unit 142 generates wkey9 using wkey10 held in the round key B register, and writes to the round key A register. Holding wkey9, the next decryption start (T27) is prepared.

As described above, when the key extension 142 is operated, the modified round function module 146 may use the round key in each cycle as shown in FIG.

The operation during the decoding period according to the present embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the decoding operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 28A and 28B, decoding of the second block is started at the shortest interval after completion of decoding of the first block. The AES core can achieve its maximum performance by executing decryption of all blocks at this timing. However, the decryption interval can basically be set to any length.

When the decryption of the predetermined number of blocks is completely terminated and the next operation is to be executed using another parameter such as an encryption key, the process starts again from the parameter setting.

The third embodiment can be implemented in this way. In the third embodiment, the maximum value of the summation of the signal processing times for each subblock transform that must be executed in one cycle increases somewhat. However, since the maximum value of the sum of signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time, this is not a problem in most cases. Thus, in most cases, the number of clock cycles required for AES encryption and decryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

As mentioned above, a number of embodiments can be obtained in addition to the basic first embodiment by applying the concept of the present invention. Examples are the second and third embodiments. As shown in Fig. 26 showing the configuration of executing AddRoundKey conversion twice in the eighth cycle, the configuration of executing AddRoundKey conversion twice in any cycle of encryption is also possible. The examples are for illustrative purposes only, and the effects of the present invention are not limited to the examples.

Fourth Example

In the fourth embodiment, decryption is performed using the equivalent inverse cipher described in FIPS197.

Fig. 29 shows a comparison between the processing contents of encryption executed in clock cycles in the prior art and the fourth embodiment.

Referring to Fig. 29, the cycle count indicates a clock cycle count that is "0" at the start of AES processing.

In the present embodiment, AddRoundKey conversion, ShiftRows conversion, SubBytes conversion, and MixColumns conversion are executed in the 0th to 8th cycles. In the ninth cycle, the first AddRoundKey transformation, the ShiftRows transformation, the SubBytes transformation, and the second AddRoundKey transformation are executed. As the round key, wkeyO is used in the 0th cycle, wkeyl in the 1st cycle, ..., and wkey8 in the 8th cycle. In the ninth cycle, two round keys wkey9 and wkeylO are used.

In the fourth embodiment, the same processing as in the prior art is executed as a whole. However, in the fourth embodiment, AES encryption can be executed in clock cycles fewer by one.

Next, according to the fourth embodiment, the sum of the encryption processing times for each subblock conversion within each clock cycle period will be described. FIG. 31 is a diagram showing a comparison between the sum of the encryption processing time for each subblock transformation within each clock cycle period of the prior art and the fourth embodiment. FIG. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement the fourth embodiment, the maximum of the sum of the signal processing times of each subblock conversion within each clock cycle period must be less than one clock cycle time. As shown in Fig. 31, the processing time of each subblock transform has the longest SubBytes transform, and is short in the order of MixColumns transform, AddRoundKey transform, and ShiftRows transform.

In the fourth embodiment, the sum of the signal processing time for each subblock transform in each of the 0th to 8th cycles in which AddRoundKey transform, SubBytes transform, ShiftRows transform, and MixColumns transform is performed is performed by the first AddRoundKey transform, SubBytes transform, It is longer than the sum of the signal processing times for each subblock transform in the ninth cycle in which the ShiftRows transform and the second AddRoundKey transform are performed. Therefore, in the fourth embodiment, the maximum value of the sum of the signal processing times for each subblock transform executed in one cycle is the same as in the prior art. If the maximum value of the sum of the signal processing times for each subblock transform executed in one cycle is shorter than one cycle time in the prior art, the present embodiment can also be implemented.

The present invention is also applicable to AES decryption.

Fig. 30 shows a comparison between the processing contents of decryption executed in clock cycles of the fourth embodiment and those of the prior art.

Referring to Fig. 30, the cycle count indicates a clock cycle count that is "0" at the start of the processing of the AES. The modified decryption key wkeyi '(i is the number of rounds) is the round key required for the equivalent inverse cipher described in FIPS197.

In the fourth embodiment, AddRoundKey transformation, InvShiftRows transformation, InvSubBytes transformation, and InvMixColumns transformation are performed in the 0th to 8th cycles. In the ninth cycle, the first AddRoundKey transformation, the InvShiftRows transformation, the InvSubBytes transformation, and the second AddRoundKey transformation are executed. As the round key, wkey10 is used in the 0th cycle, wkey9 'in the 1st cycle, ..., and wkey2' in the 8th cycle. In the ninth cycle, two round keys wkey1 'and wkey0 are used.

In the fourth embodiment, the same processing as in the prior art is executed as a whole. However, in the fourth embodiment, AES decryption can be executed in clock cycles fewer by one.

Next, the sum of the decoding processing time for each subblock conversion within each clock cycle period will be described according to the fourth embodiment. FIG. 31 is a diagram showing the sum of decoding processing time for each subblock transformation and comparison with the prior art in each clock cycle period in the fourth embodiment. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement this embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period must be less than one cycle time. As shown in Fig. 31, the processing time of each subblock transform is the longest in InvSubBytes transform, and is short in the order of InvMixColumns transform, AddRoundKey transform, and InvShiftRows transform.

 In the fourth embodiment, the sum of the signal processing times for each subblock transform in each of the 0th to 8th cycles in which the AddRoundKey transform, InvSubBytes transform, InvShiftRows transform, and InvMixColumns transform are performed is performed by the first AddRoundKey transform, InvSubBytes transform, It is longer than the sum of the signal processing time for each subblock transform in the ninth cycle in which the InvShiftRows transform and the second AddRoundKey transform are executed. Therefore, in the present embodiment, the maximum value of the sum of the signal processing times for each subblock conversion executed within one clock cycle is the same as in the prior art. If the maximum value of the summation of the signal processing times for each subblock transform executed in one cycle is shorter than one cycle time in the prior art, this embodiment can also be implemented.

The above-mentioned features of the fourth embodiment are summarized.

In the conventional general implementation method, the round function defined in the standard is regarded as a break in processing, and encryption and decryption are distributed among clock cycles. Thus, the sum of the signal processing times for each subblock transform in the 10th and 0th cycles is shorter than the sum of the signal processing times for each subblock transform in each of the 1st to 9th cycles. In other words, the sum of the signal processing times for each subblock transform in each cycle varies.

On the other hand, in the fourth embodiment, the signal processing in some clock cycles is increased so that the difference between the sum of the signal processing times for each subblock conversion within each clock cycle period is minimized. In the present invention, the number of clock cycles required for AES encryption or decryption is reduced by one cycle without increasing the sum of the signal processing time for each subblock transformation executed in one cycle. This increases the AES processing speed by about 10%.

Next, a circuit configuration of the AES core for implementing AES encryption and decryption will be described.

32 is a block diagram of an AES core according to a fourth embodiment.

Referring to Fig. 32, the AES Core 201 executes AES processing. The key expansion unit 202 generates a round key for AES encryption and decryption from the encryption key and outputs the round key. The encryption / decryption section 203 performs encryption of 128-bit plain text data or decryption of 128-bit cipher text data using the round key supplied from the key expansion section 202. The control unit 204 receives a control signal from a unit external to the AES core 201 to control signals of the key expansion unit 202 and the encryption / decryption unit 203 and external to the AES core 201. Generate a signal to notify the unit of completion of the operation.

The components and signal lines in Fig. 32 are the same as those described in the first embodiment, and the description thereof is omitted.

Next, the encryption / decryption unit 203 will be described. 33 is a block diagram of the encryption / decryption unit 203. Referring to FIG. 33, the modified round function module 205 may be configured to include a round key A 162 and a round key B (under control of the selection signal 170, the encryption / decryption selection signal 153, and the selection signal 175). 163) performs encryption or decryption for one cycle.

In the above configuration, when the selection signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108.

The components and signal lines in FIG. 33 are the same as those described in the first embodiment, and description thereof is omitted.

Next, the modified round function module 205 will be described. 34 is a block diagram of a modified round function module 205. Referring to FIG. 34, the AddRoundKey conversion module 110 receives an input signal 165 and a round key A 162 and performs AddRoundKey conversion. The SubBytes / InvSubBytes conversion module 222 receives the output of the AddRoundKey conversion module 110 and performs one of SubBytes conversion and InvSubBytes conversion according to the encryption / decryption selection signal 153. The ShiftRows / InvShifRows conversion module 223 receives the output of the SubBytes / InvSubBytets conversion module 222 and executes one of the ShiftRows conversion and the InvShiftRows conversion according to the encryption / decryption selection signal 153. The MixColumns / InvMixColumn conversion module 224 receives the output of the ShiftRows / InvShiftRows conversion module 223 and executes either MixColumns or InvMixColumns conversion according to the encryption / decryption selection signal 153. The AddRoundKey conversion module 114 receives the output of the ShiftRows / InvShiftRows conversion module 223 and executes AddRoundKey conversion. The selector 115 selects and outputs one of an output of the MixColumns / InvMixColumns conversion module 224 and an output of the AddRoundKey conversion module 114 according to the selection signal 170. The output signal of the selector 115 is the output signal of the modified round function module 205.

In the above configuration, when the selection signal 170 is negated, the selector 115 selects and outputs the output of the MixColumns / InvMixColumns conversion module 224. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114. When the encryption / decryption selection signal 153 is negated, the SubBytes / InvSubBytes conversion module 222, the ShiftRows / InvShiftRows conversion module 223, and the MixColumns / InvMixColumns conversion module 224 perform SubBytes conversion, ShiftRows conversion, and MixColumns. Run each transformation. When the encryption / decryption selection signal 153 is asserted, they perform InvSubBytes transformation, InvShiftRows transformation, and InvMixColumns transformation, respectively.

Next, the encryption operation in the above configuration will be described with reference to the timing charts of FIGS. 9A and 9B. 9A and 9B, the abscissa represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse.

The three digits on the vertical axis of the left end of Fig. 9A represent signal lines and correspond one-to-one to the reference numbers of the signal lines used in Figs.

The encryption operation shown in the timing chart of Figs. 9A and 9B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in the first embodiment. The key preparation period is from T06 to T17. The start condition, end condition, and operation of each circuit in the key preparation period are the same as those described in the first embodiment, and description thereof is omitted.

The encryption period of the first block is from T17 to T27, and its start condition and end condition are the same as in the first embodiment. The operation of each circuit is also almost the same as in the first embodiment.

The control unit 204 asserts the selection signal 170 in the final cycle T16 of encryption and negates it at the end of encryption (T17). The control unit 204 also asserts the selection signal 171 in the first cycle of encryption and negates it at the end of encryption.

As described with respect to the circuit configuration, when the selection signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When select signal 170 is negated, selector 115 selects and outputs the output of MixColumns / InvMixColumns conversion module 224. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114. When the encryption / decryption selection signal 153 is negated, the SubBytets / InvSubBytes conversion module 222, the ShiftRows / InvShifRows conversion module 223, and the MixColumns / InvMixColumns conversion module 224 perform SubBytes conversion, ShiftRows conversion, and MixColumns. Run each transformation. When the encryption / decryption selection signal 153 is asserted, they perform InvSubBytes transformation, InvShiftRows transformation, and InvMixColumns transformation, respectively.

Therefore, in the 0 th cycle T17 to T18, the modified round function module 205 performs AddRoundKey transformation, SubBytets transformation, ShiftRows transformation, and MixColumns transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, and MixColumns transformation on the result of the previous cycle. In the ninth cycle T26 to T27, the modified round function module outputs the result obtained by executing AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, and AddRoundKey transformation.

The modified round function module 205 can execute encryption as shown in FIG. 29 by controlling the selection signals 171 and 170 in this manner.

On the other hand, the key expansion unit 202 outputs wkey0 as the round key A 162 and wkey10 as the round key B 162 after the key preparation period. Therefore, wkey0 is supplied to the modified round function module 205 at the start of encryption (T17). Upon detecting the start of encryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 202 generates wkey1 using wkey0 held in the round key A register, and wkey1 in the round key A register. Keep it. Thus, wkey1 is supplied to the modified round function module 205 at T18. Round keys are supplied in the same manner until timing T26. At T26, two round keys wkey9 and wkey10 are supplied that function as the round key B 163. When wkey9 is held in the round key A register and the round key supply is terminated at T26 (T26), the key expansion unit 202 keeps wkey0 supplied externally as the encryption key 152 in the round key A register, Next, start of encryption (T27) is prepared.

When the key extension 202 operates as described above, the modified round function module 205 can use the round key in each cycle as shown in FIG.

The operation during the encryption period according to the fourth embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the encryption operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 9A and 9B, the encryption of the second block is started at the shortest interval after the termination of the encryption of the first block. The AES core can achieve its maximum performance by executing encryption of all blocks at this timing. However, the encryption interval can basically be set to any length.

When the encryption of the predetermined number of blocks is completely terminated and the next operation must be executed using another parameter such as an encryption key, the process starts again from the parameter setting.

Next, the decoding operation of this embodiment will be described. 35A and 35B are a timing chart of decoding according to the fourth embodiment. 35A and 35B, the abscissa represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis of the left end of FIG. 35A represent signal lines and correspond one-to-one with reference numerals of the signal lines used in FIGS. 32 to 34.

The decoding operation shown in the timing chart of Figs. 35A and 35B is also roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third part is the decoding periods T17 to T27 of the first block. The fourth part is the decoding period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in encryption of the first embodiment.

The key preparation period is from T06 to T17, the start condition and end condition are the same as those described in the encryption of the first embodiment, and the description thereof is omitted. The operation of each circuit is almost the same as in the encryption of this embodiment. However, operations of the key expansion unit 202 at the timing T16 and operations of the key expansion unit 202 and the control unit 204 at the timing T17 are different from those in encryption, and will be described below.

At timing T16, the key expansion unit 202 outputs wkey0 as the round key B 163 and wkey10 as the round key A 162. The round key wkey0 is held in a register provided in the key expansion section 202. At timing T16, the key expansion unit 202 performs key expansion inverse from wkey10 to generate the modified decryption key wkey9 '.

At timing T17, the key expansion unit 202 outputs wkey9 'as the round key A 162. The control unit 204 asserts the selection signal 170.

The decoding period of the first block is from T17 to T27, and the start condition and end condition are the same as in the first embodiment. The operation of each circuit is also almost the same as in the first embodiment.

The control unit 204 asserts the selection signal 170 in the final cycle T16 of decoding and negates it at the end of decoding (T17). The control unit 204 also asserts the selection signal 171 in the first cycle of decoding and negates it at the end of decoding.

 As described with respect to the circuit configuration, when the select signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When the selection signal 170 is negated, the selector 115 selects and outputs the output of the MixColumns / InvMimxColumns conversion module 224. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114. When the encryption / decryption selection signal 153 is negated, the SubBytes / InvSubBytes conversion module 222, the ShiftRows / InvShiftRows conversion module 223, and the MixColumns / InvMixColumns conversion module 224 perform SubBytes conversion, ShiftRows conversion, and MixColumns. Perform each conversion. When the encryption / decryption selection signal 153 is asserted, they perform InvSubBytes transformation, InvShiftRows transformation, and InvMixColumns transformation, respectively.

Therefore, in the 0 th cycle T17 to T18, the modified round function module 205 performs AddRoundKey transformation, InvSubBytes transformation, InvShiftRows transformation, and InvMixColumns transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing AddRoundKey transformation, InvSubBytes transformation, InvShiftRows transformation, and MixColumns transformation on the result of the previous cycle. In the ninth cycle T26 to T27, the modified round function module outputs the result obtained by executing AddRoundKey transformation, InvSubBytes transformation, InvShiftRows transformation, and AddRoundKey transformation.

By controlling the selection signals 171 and 170 in the above-described manner, the modified round function module 205 can execute decoding as shown in FIG.

On the other hand, the key expansion unit 202 outputs wkey10 as the round key A 162 and wkey0 as the round key B 163 after the key preparation period. Therefore, wkey10 is supplied to the modified round function module 205 at the start of decryption (T17). Upon detecting the start of decryption on the basis of the encryption / decryption start signal 158 (T17), the key expansion unit 202 generates wkey9 'using wkey10 held in the round key A register, and generates a round key A register. Keep wkey9 '. Thus, wkey9 'is supplied to the modified round function module 202 at T18. Round keys are supplied in the same way up to timing T26. At timing T26, two round keys wkey1 'and wkey0 serving as round key B 163 are supplied. When wkey1 'is held in the round key A register and the round key supply is terminated at T26 (T26), the key expansion unit 202 loads wkey10 held in the internal register of the key expansion unit into the round key A register, and then decrypts it. To start (T27).

When the key extension 202 is operating as described above, the modified round function module 205 may use the round key in each cycle as shown in FIG.

Operation during the decoding period according to the fourth embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the decoding operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 35A and 35B, decoding of the second block is started at the shortest interval after completion of decoding of the first block. The AES core can achieve its maximum performance by executing decryption of all blocks at this timing. However, the decryption interval can basically be set to any length.

When the decryption of the predetermined number of blocks is completely finished and the next operation is to be performed using another parameter such as an encryption key, the process starts again from the parameter setting.

The fourth embodiment can be implemented by the above method. In the fourth embodiment, a circuit configuration and an operation for performing decryption using an equivalent inverse cipher have been described. In the fourth embodiment, the number of clock cycles required for AES encryption is reduced by one cycle without increasing the maximum of the sum of signal processing times for each subblock conversion within each clock cycle period. This increases the AES processing speed by about 10%.

The fourth embodiment is merely an example of the present invention, and the effects of the present invention are not limited to the above embodiment.

Fifth Embodiment

In the fifth embodiment, decryption is performed using the equivalent inverse cipher described in FIPS197.

36 is a diagram showing processing contents of encryption and decryption executed in clock cycles according to the fifth embodiment.

Referring to Fig. 36, a cycle count indicates a clock cycle count that is "0" at the start of AES processing.

In the encryption of the present embodiment, in the 0th cycle, the first AddRoundKey transformation, ShiftRows transformation, SubBytes transformation, MixColumns transformation, and the second AddRoundKey transformation are executed using two round keys. In the first to eighth cycles, AddRoundKey conversion, ShiftRows conversion, SubBytes conversion, and MixColumns conversion are performed. In the ninth cycle, AddRoundKey transformation, ShiftRows transformation, and SubBytes transformation are performed. As the round key, wkeyO and wkey1 in the 0th cycle, wkey2 in the 1st cycle, ..., and wkey10 in the 9th cycle are used.

In the fifth embodiment, the same processing as in the prior art is executed as a whole. In this embodiment, however, AES encryption can be executed in clock cycles fewer by one.

Next, the sum of the encryption processing time for each subblock conversion within each clock cycle period will be described according to the fifth embodiment. FIG. 37 is a diagram showing a comparison between the sum of the signal processing time for each subblock conversion executed in the clock cycle of the prior art and the fifth embodiment. FIG. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement the fifth embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period must be less than one clock cycle time. As shown in Fig. 37, the processing time of each subblock transform is the longest in the SubBytes transform, and is short in the order of MixColumns transform, AddRoundKey transform, and ShiftRows transform.

In the fifth embodiment, the sum of the signal processing time for each subblock transformation of the 0th cycle in which the first AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, MixColumns transformation, and the second AddRoundKey transformation is performed is the AddRoundKey transformation, SubBytes Sum of signal processing time for each subblock transform in the first to eighth cycles where the transform, ShiftRows transform, and MixClumns transform are performed, or each in the ninth cycle in which the AddRoundKey, SubBytes, and ShiftRows transforms are performed. It is longer than the sum of the signal processing times for the subblock transformations. Therefore, in the fifth embodiment, the maximum value of the sum of the signal processing times for each subblock transform is as large as the processing time of one AddRoundKey transform as compared with the prior art. However, the processing time of one AddRoundKey transformation is much shorter than the sum of the signal processing times for each subblock transformation in one cycle. The maximum sum of the signal processing time for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. Therefore, in the prior art, it is assumed that the present embodiment can also be implemented in most cases if the maximum value of the sum of the signal processing times for each subblock transformation within each cycle period is shorter than one cycle time.

The present invention is also applicable to AES decryption.

As shown in Fig. 36, in the decoding of the present embodiment, the first AddRoundKey transformation, InvShiftRows transformation, InvSubBytes transformation, InvMixColumns transformation, and second AddRoundKey transformation are executed in the 0th cycle. In the first to eighth cycles, AddRoundKey conversion, InvShiftRows conversion, InvSubBytes conversion, and InvMixColumns conversion are executed. In the ninth cycle, the AddRoundKey transformation, InvShiftRows transformation, and InvSubBytes transformation are executed. As the round key, wkey10 and wkey9 'are used in the 0th cycle, wkey8' is used in the first cycle, ..., wkey0 is used in the ninth cycle.

In the fifth embodiment, the same processing as in the prior art is executed as a whole. However, in the fifth embodiment, AES decryption can be executed in clock cycles fewer by one.

Next, according to the fifth embodiment, the sum of the decoding processing times for each subblock conversion within each clock cycle period will be described. FIG. 37 is a view showing the sum of the decoding processing time for each subblock transformation within each clock cycle period in the fifth embodiment and comparison with the prior art. FIG. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement this embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period should be less than one cycle time. As shown in FIG. 37, the processing time of each subblock transform is the longest in InvSubBytes transform, and is short in the order of InvMixColumns transform, AddRoundKey transform, and InvShiftRows transform.

 In the fifth embodiment, the sum of the signal processing times for each subblock transform in the 0th cycle in which the AddRoundKey transform, InvSubBytes transform, InvShiftRows transform, InvMixColumns transform, and AddRoundKey transform are executed is performed by AddRoundKey transform, InvSubBytes transform, InvShiftRows transform, And summing the signal processing time for each subblock transform in the 0th through 8th cycles where the InvMixColumns transform is performed, or for each subblock transform in the 9th cycle where the AddRoundKey transform, InvSubBytes transform, and InvShiftRows transform are performed. It is longer than the sum of the signal processing times. Therefore, the maximum value of the sum of the signal processing time for each subblock transformation of the fifth embodiment is larger than the prior art by corresponding to the processing time of one AddRoundKey transformation. However, the processing time of one AddRoundKey transformation is much shorter than the sum of the signal processing times for each subblock transformation within one cycle. The maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. Therefore, it is assumed that the present embodiment can also be implemented in most cases if the maximum value of the sum of the decoding processing times for each subblock transformation within each clock cycle period of the prior art is shorter than one cycle time.

The features of the fifth embodiment are summarized.

In a conventional general implementation method, the round function defined by the specification is regarded as a break in processing, so that encryption and decryption are distributed among clock cycles. Therefore, the sum of the signal processing times for each subblock transform in the 10th and 0th cycles is shorter than the sum of the signal processing times for each subblock transform in each of the 1st to 9th cycles. That is, the sum of the signal processing times for each subblock transform executed in each cycle varies.

On the other hand, in the fifth embodiment, the signal processing in some clock cycles is increased so that the difference between the sum of the signal processing times for each subblock conversion within each clock cycle period is reduced.

In the fifth embodiment, the maximum of the summation of the signal processing times for each subblock transform executed in one cycle is somewhat increased. Thus, this embodiment need not necessarily be implemented under the conditions in which the prior art can be implemented. However, this is not a problem in most cases, since the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. In most cases, the number of clock cycles required for AES encryption or decryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

Next, a circuit configuration of the AES core for implementing AES encryption and decryption will be described.

38 is a block diagram of an AES Core according to the fifth embodiment. Referring to FIG. 38, the AES Core 231 executes AES processing. The key expansion unit 232 generates a round key for AES encryption and decryption from the encryption key and outputs the round key. The encryption / decryption unit 233 performs encryption of 128-bit plain text data or decryption of 128-bit cipher text data using the round key supplied from the key expansion unit 232. The control unit 234 receives a control signal from a unit outside the AES core 231 to control signals of the key expansion unit 232 and the encryption / decryption unit 233 and the outside of the AES core 231. Generate a signal to notify the unit of completion of the operation.

The components and signal lines in FIG. 38 are the same as those described in the first and second embodiments, and description thereof is omitted.

Next, the encryption / decryption unit 233 will be described. 39 is a block diagram of the encryption / decryption unit 233. Referring to FIG. 39, the modified round function module 235 uses the round key A 162 and the round key B 163 under the control of the selection signals 170 and 175 and the encryption / decryption selection signal 153. Encrypt or decrypt for one cycle.

In the above configuration, when the selection signal 171 is negated, the selector 109 of the encryption / decryption section 233 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108.

The components and signal lines in FIG. 39 are the same as those described in the first and second embodiments, and description thereof is omitted.

Next, the modified round function module 235 will be described. 40 is a block diagram of a modified round function module 235. Referring to FIG. 40, the AddRoundKey conversion module 114 receives an input signal 165 and a round key B 163 and performs AddRoundKey conversion. The selector 137 selects one of the input signal 165 and the output of the AddRoundKey conversion module 114 according to the selection signal 175. The SubBytes / InvSubBytes conversion module 222 receives the output of the selector 137 and executes one of SubBytes conversion and InvSubBytes conversion according to the encryption / decryption selection signal 153. The ShiftRows / InvShifRows conversion module 223 receives the output of the SubBytes / InvSubBytets conversion module 222 and executes one of the ShiftRows conversion and the InvShiftRows conversion according to the encryption / decryption selection signal 153. The MixColumns / InvMixColumn conversion module 224 receives the output of the ShiftRows / InvShiftRows conversion module 223 and executes either MixColumns or InvMixColumns conversion according to the encryption / decryption selection signal 153. The selector 115 selects and outputs one of the output of the MixColumns / InvMixColumns conversion module 224 and the output of the ShiftRows / InvShiftRows conversion module 223 according to the selection signal 170. The AddRoundKey conversion module 110 receives the output of the selector 115 and the round key A 162 to perform AddRoundKey conversion. The output signal of the AddRoundKey conversion module 110 is the output signal of the modified round function module 235.

In the above configuration, when the selection signal 170 is negated, the selector 115 selects and outputs the output of the MixColumns / InvMixColumns conversion module 224. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the ShiftRows / InvShiftRows conversion module 223. When select signal 175 is negated, selector 137 selects and outputs input signal 165. When the selection signal 175 is asserted, the selector 137 selects and outputs the output of the AddRoundKey conversion module 114.

The encryption operation in the above configuration will be described with reference to the timing charts of Figs. 18A and 18B. Three digits on the vertical axis of the left end of Fig. 18A represent signal lines and correspond one-to-one to the reference numbers of the signal lines used in Figs. 38 to 40.

The encryption operation shown in the timing chart of Figs. 18A and 18B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in the second embodiment. The key preparation period is from T06 to T17. The start condition, end condition, and operation of each circuit of the key preparation period are the same as those described in the second embodiment, and the description thereof is omitted. The first block encryption period is from T17 to T27, and the start condition and end condition are the same as in the second embodiment. The operation of each circuit is also almost the same as in the second embodiment.

The control unit 234 asserts the selection signal 175 at the end of encryption T16 and negates it in the first cycle T18 or T28 of encryption. The control unit 234 also asserts the selection signal 170 in the final cycle of encryption T16 and negates it at the end of encryption (T17). The control unit 234 also asserts the selection signal 171 in the first cycle of encryption and negates it at the end of encryption.

As described with respect to the circuit configuration, when the selection signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When select signal 170 is negated, selector 115 selects and outputs the output of input signal 165. When the selection signal 170 is asserted, the selector 115 selects and outputs the result of the AddRoundKey conversion module 114. When the select signal 175 is negated, the selector 137 selects and outputs the result of the MixClolumns / InvMixColumns conversion module 224. When the selection signal 175 is asserted, the selector 137 selects and outputs the result of the ShiftRows / InvShiftRows conversion module 223. When the encryption / decryption selection signal 153 is negated, the SubBytets / InvSubBytes conversion module 222, the ShiftRows / InvShifRows conversion module 223, and the MixColumns / InvMixColumns conversion module 224 perform SubBytes conversion, ShiftRows conversion, and MixColumns. Run each transformation. When the encryption / decryption selection signal 153 is asserted, they perform InvSubBytes transformation, InvShiftRows transformation, and InvMixColumns transformation, respectively.

Therefore, in the 0 th cycle T17 to T18, the modified round function module 235 performs AddRoundKey transformation, SubBytets transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by performing SubBytes transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation on the result of the previous cycle. In the ninth cycle (T26 to T27), the modified round function module outputs the result obtained by executing the SubBytes transformation, the ShiftRows transformation, and the AddRoundKey transformation.

The modified round function module 235 can execute encryption as shown in FIG. 36 by controlling the selection signals 171, 170, and 175 in this manner.

On the other hand, the key expansion unit 232 outputs wkey1 as the round key A 162 and wkey0 as the round key B 163 after the key preparation period. Therefore, wkey0 and wkey1 are supplied to the modified round function module 235 at the start of encryption (T17). Upon detecting the start of encryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 232 generates wkey2 using wkey1 held in the round key A register, and wkey2 in the round key A register. Keep it. Therefore, wkey2 is supplied to the modified round function module 235 at timing T18. Round keys are supplied in the same way up to timing T26. When wkey10 is maintained in the round key A register and the round key supply is terminated at timing T26, the key expansion unit 232 generates wkey1 using wkey0 supplied externally as the encryption key 152, and wkey1 is selected. Holding in the round key A register prepares the next encryption start (T27).

As described above, when the key extension 232 is operated, the modified round function module 235 may use the round key in each cycle as shown in FIG.

The operation during the encryption period according to the fifth embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the encryption operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 18A and 18B, the encryption of the second block is started at the shortest interval after the termination of the encryption of the first block. The AES core can achieve its maximum performance by executing encryption of all blocks at this timing. However, the encryption interval can basically be set to any length.

When the encryption of the predetermined number of blocks is completely terminated and the next operation must be executed using another parameter such as an encryption key, the process starts again from the parameter setting.

Next, the decoding operation of the fifth embodiment will be described. 41A and 41B are timing charts of decoding according to the fifth embodiment. 41A and 41B, the abscissa represents the time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse.

Three digits on the vertical axis of the left end of FIG. 41A represent signal lines and correspond one-to-one with reference numbers of the signal lines used in FIGS. 38 to 40.

The decoding operation shown in the timing chart of Figs. 41A and 41B is also roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third part is the decoding periods T17 to T27 of the first block. The fourth part is the decoding period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in encryption of this embodiment. In decryption, however, the encryption / decryption selection signal 153 is asserted.

The key preparation period is from T06 to T17, and the start condition and end condition are the same as described in the encryption of this embodiment. The operation of each circuit is almost the same as in the encryption of this embodiment. However, the operation of the key expansion unit 232 at the T16 timing and the operation of the key expansion unit 232 and the control unit 234 at the T17 timing are different from those in the encryption, and will be described below.

At timing T16, the key expansion section 232 outputs wkey10 as the round key B 163 and wkey10 as the round key A 162. At timing T16, the key expansion unit 232 performs key expansion inverse from wkey10 to generate the modified decryption key wkey9 '.

At timing T17, the key expansion section 232 outputs wkey9 'as the round key A 162. The controller 234 asserts the selection signal 175.

At the end of the key preparation period T17, the control unit 234 asserts the selection signal 175.

The first block decoding period is from T17 to T27, and the start condition and end condition are the same as in the first embodiment. The operation of each circuit is also almost the same as in the first embodiment.

The control unit 234 asserts the selection signal 170 in the final cycle T16 of decryption and negates the first cycle T18 or T28 of decryption. The control unit 234 also asserts the selection signal 175 at the end of decoding (T17) and negates it at the end of decoding (T17). The control unit 234 also asserts the selection signal 171 in the first cycle of decryption and negates it at the end of decryption.

 As described with respect to the circuit configuration, when the selection signal 171 is gated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108.

When select signal 175 is negated, selector 137 selects and outputs input input signal 165. When the selection signal 175 is asserted, the selector 137 selects and outputs the output of the AddRoundKey conversion module 114. When select signal 170 is negated, selector 115 selects and outputs the output of MixColumns / InvMixColumns conversion module 224. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the ShiftRows / InvShiftRows conversion module 223.

Thus, in the 0 th cycle T17 to T18, the modified round function module 235 performs AddRoundKey transformation, InvShiftRows transformation, InvSubBytes transformation, AddRoundKey transformation, and InvMixColumns transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing InvShiftRows transformation, InvSubBytes transformation, AddRoundKey transformation, and InvMixColumns transformation on the result of the previous cycle. In the ninth cycle T26 to T27, the modified round function module outputs the result obtained by executing the InvShiftRows transformation, the InvSubBytes transformation, and the AddRoundKey transformation.

By controlling the selection signals 171, 170, and 175 in the above-described manner, the modified round function module 235 can perform decryption as shown in FIG. 36.

On the other hand, the key expansion unit 232 outputs wkey9 'as the round key A 162 and wkey10 as the round key B 163 after the key preparation period. Therefore, wkey10 and wkey9 'are supplied to the modified round function module 235 at the start of decryption (T17). Upon detecting the start of decryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 232 generates wkey8 'using wkey9' held in the round key A register, and round key A register. Keep wkey8 ' Thus, wkey8 'is supplied to the modified round function module 235 at T18. Round keys are supplied in the same way up to T26. When wkey0 is held in the round key A register and the round key supply is terminated at T26, the key expansion unit 232 generates wkey9 'using wkey10 held in the round key B register, and converts wkey9' to the round key A register. In the next step, the next decoding start T27 is prepared.

As described above, when the key extension 232 is operated, the modified round function module 235 may use the round key in each cycle as shown in FIG.

Operation during the decoding period according to the fifth embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the decoding operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 41A and 41B, decoding of the second block is started at the shortest interval after completion of decoding of the first block. The AES core can achieve its maximum performance by executing decryption of all blocks at this timing. However, the decryption interval can basically be set to any length.

When the decryption of the predetermined number of blocks is completely terminated and the next operation is to be executed using another parameter such as an encryption key, the process starts again from the parameter setting.

The fifth embodiment can be implemented in this way. In the fifth embodiment, the maximum value of the sum of the signal processing times for each subblock transform that should be executed in one cycle is somewhat increased. However, this is not a problem in most cases since the maximum of the summation of the signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. Thus, in most cases, the number of clock cycles required for AES encryption and decryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

The fifth embodiment is merely an example of the present invention, and the effects of the present invention are not limited to the above embodiment.

Sixth Example

In the sixth embodiment, decryption is performed using the equivalent inverse cipher described in FIPS197.

Fig. 42 is a diagram showing the processing contents of encryption and decryption executed in clock cycles according to the sixth embodiment.

Referring to Fig. 42, a cycle count indicates a clock cycle count that is "0" at the start of AES processing.

In the sixth embodiment, the first AddRoundKey transformation, SubBytes / InvSubBytes transformation, ShiftRows / InvShiftRows transformation, MixColumns / InvMixColumns transformation, and the second AddRoundKey transformation are executed using two round keys. In the first to eighth cycles, SubBytes / InvSubBytes conversion, ShiftRows / InvShiftRows conversion, MixColumns / InvMixColumns conversion, and AddRoundKey conversion are executed. In the ninth cycle, SubBytes / InvSubBytes conversion, ShiftRows / InvShiftRows conversion, and AddRoundKey conversion are performed. SubBytes / InvSubBytes conversion indicates that SubBytes conversion is performed in encryption, and SubBytes conversion is performed in decryption. ShiftRows / InvShiftRows conversion indicates that ShiftRows conversion is performed in encryption, and InvShiftRows conversion is performed in decryption. MixColumns / InvMixColumns conversion indicates that MixColumns conversion is performed in encryption, and InvMixColumns is executed in decryption.

As the round key used in the encryption of this embodiment, wkeyO and wkey1 in the 0th cycle, wkey2 in the 1st cycle, ..., wkey10 in the ninth cycle. The round keys used for the decoding are wkey10 and wkey9 'in the 0th cycle, wkey8' in the 1st cycle, ..., and wkey0 in the 9th cycle.

In the sixth embodiment, the same processing as in the prior art is executed as a whole. In this embodiment, however, AES encryption and decryption can be executed in clock cycles fewer by one.

Next, the sum of the encryption processing times for each subblock conversion within each clock cycle period will be described according to the present embodiment. FIG. 43 shows a comparison between the sum of the signal processing time for each subblock conversion executed in the clock cycle of the prior art and the sixth embodiment. FIG. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement the sixth embodiment, the maximum of the sum of the signal processing time of each subblock conversion within each clock cycle period must be less than one clock cycle time. As shown in FIG. 43, the processing time of each subblock transform is the longest in the SubBytes transform, and is short in the order of the MixColumns transform, the AddRoundKey transform, and the ShiftRows transform.

In the present embodiment, the sum of signal processing times for each subblock transformation of the 0th cycle in which AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation are performed is performed by AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, And summation of the signal processing times for each subblock transformation within the first to eighth cycles in which the MixClumns transformation is performed, or signal processing for each subblock transformation in the ninth cycle in which the AddRoundKey transformation, SubBytes transformation, and ShiftRows transformation are performed. It is longer than the sum of time. 43 is also applicable to decryption, and applies to decryption as described above. Therefore, in the fifth embodiment, the maximum value of the sum of the signal processing times for each subblock transform is as large as the processing time of one AddRoundKey transform as compared with the prior art. However, the processing time of one AddRoundKey transformation is much shorter than the sum of the signal processing times for each subblock transformation within one cycle. The maximum sum of the signal processing time for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. Therefore, in the prior art, it is assumed that the present embodiment can also be implemented in most cases if the maximum value of the sum of the signal processing times for each subblock transformation within each cycle period is shorter than one cycle time.

The features of the sixth embodiment are summarized.

In a conventional general implementation method, the round function defined by the specification is regarded as a break in processing, so that encryption and decryption are distributed among clock cycles. Therefore, the sum of the signal processing times for each subblock transform in the 10th and 0th cycles is shorter than the sum of the signal processing times for each subblock transform in each of the 1st to 9th cycles. That is, the sum of the signal processing times for each subblock transform executed in each cycle varies.

On the other hand, in the sixth embodiment, the signal processing in some clock cycles is increased so that the difference between the sum of the signal processing times for each subblock conversion within each clock cycle period is reduced.

In the sixth embodiment, the maximum of the sum of signal processing times for each subblock transform executed in one cycle is somewhat increased. Thus, the sixth embodiment does not necessarily need to be implemented under the condition that the prior art can be implemented. However, since the maximum value of the sum of signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time, this is not a problem in most cases. In most cases, the number of clock cycles required for AES encryption or decryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

Next, a circuit configuration of the AES core for implementing AES encryption and decryption will be described.

44 is a block diagram of an AES core according to the present embodiment. Referring to Fig. 44, the AES Core 241 executes AES processing. The key expansion unit 242 generates a round key for AES encryption and decryption from the encryption key and outputs the round key. The encryption / decryption section 243 performs encryption of 128-bit plain text data or decryption of 128-bit cipher text data using the round key supplied from the key expansion section 242. The control unit 244 receives a control signal from a unit external to the AES core 241, and controls signals of the key expansion unit 242 and the encryption / decryption unit 243 and external to the AES core 241. Generate a signal to notify the unit of completion of the operation.

The components and signal lines of FIG. 44 are the same as those described in the first and second embodiments, and description thereof is omitted.

Next, the encryption / decryption unit 243 will be described. 45 is a block diagram of an encryption / decryption unit 243. Referring to FIG. 45, the modified round function module 245 uses the round key A 162 and the round key B 163 under the control of the selection signals 170 and 175 and the encryption / decryption selection signal 153. Encrypt or decrypt for one cycle.

In the above configuration, when the selection signal 171 is negated, the selector 109 of the encryption / decryption section 243 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108.

The components and signal lines of FIG. 45 are the same as described in the first and second embodiments, and description thereof is omitted.

Next, the modified round function module 245 will be described with reference to FIG. 46. Referring to FIG. 46, an input signal 165 and an encryption / decryption selection signal 153 are input to the MixColumns / InvMixColumns conversion module 224. An output of the MixColumns / InvMixColumns conversion module 224, an input signal 165, and a selection signal 175 are input to the selector 137. The output of the selector 137 and the round key A 162 are input to the AddRoundKey conversion module 110. The output of the AddRoundKey conversion module 110 is input to the SubBytes / InvSubBytes conversion module 222. The output of the SubBytes / InvSubBytes conversion module 22 is input to the ShiftRows / InvShiftRows conversion module 223. The output of the ShiftRows / InvShiftRows conversion module 223 and the round key B 163 are input to the AddRoundKey conversion module 114. The output of the ShiftRows / InvShiftRows conversion module 223, the output of the AddRoundKey conversion module 114, and the selection signal 170 are input to the selector 115. The output of the selector 115 is connected to the output signal 168 from the modified round function module 245. The components and signal lines of FIG. 46 are the same as described in the first, fourth, and fifth embodiments, and description thereof is omitted.

In the above configuration, when the selection signal 175 is negated, the selector 137 selects and outputs the output of the MixColumns / InvMixColumns conversion module 224. When the selection signal 175 is asserted, the selector 137 selects and outputs an input signal 165. When the selection signal 170 is negated, the selector 115 selects and outputs the output of the ShiftRows / InvShiftRows conversion module 223. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114.

The encryption operation in the above configuration will be described with reference to the timing charts of Figs. 27A and 27B. Three digits on the vertical axis of the left end of FIG. 27A represent signal lines and correspond one-to-one to reference numerals of the signal lines used in FIGS. 44 to 46.

The encryption operation shown in the timing chart of Figs. 27A and 27B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third portion is the encryption periods T17 to T27 of the first block. The fourth part is the encryption period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in the third embodiment. The key preparation period is from T06 to T17. The start condition, end condition, and operation of each circuit are the same as those described in the third embodiment, and the description thereof is omitted.

The control unit 244 asserts the selection signal 175 at the end of encryption (T16) and negates it in the first cycle (T18 or T28) of encryption. The control unit 244 also asserts the selection signal 170 in the final cycle of encryption T16 and negates it at the end of encryption (T17). The control unit 244 also asserts the selection signal 171 in the first cycle of encryption and negates it at the end of encryption.

As described with respect to the circuit configuration, when the selection signal 171 is negated, the selector 109 selects the input signal 150. When the selection signal 171 is asserted, the selector 109 selects the output of the data holding unit 108. When the selection signal 170 is negated, the selector 115 selects and outputs the output of the ShiftRows / InvShiftRows conversion module 223. When the selection signal 170 is asserted, the selector 115 selects and outputs the result of the AddRoundKey conversion module 114. When the select signal 175 is negated, the selector 137 selects and outputs the result of the MixClolumns / InvMixColumns conversion module 224. When the selection signal 175 is asserted, the selector 137 selects and outputs an input signal 165. When the encryption / decryption selection signal 153 is negated, the SubBytets / InvSubBytes conversion module 222, the ShiftRows / InvShifRows conversion module 223, and the MixColumns / InvMixColumns conversion module 224 perform SubBytes conversion, ShiftRows conversion, and MixColumns. Run each transformation. When the encryption / decryption selection signal 153 is asserted, they perform InvSubBytes transformation, InvShiftRows transformation, and InvMixColumns transformation, respectively.

Therefore, in the 0 th cycle T17 to T18, the modified round function module 245 performs AddRoundKey transformation, SubBytets transformation, and ShiftRows transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by performing SubBytes transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation on the result of the previous cycle. In the ninth cycle (T26 to T27), the modified round function module outputs the result obtained by executing the MixColumns transformation, AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, and AddRoundKey transformation.

The modified round function module 245 can execute encryption as shown in FIG. 42 by controlling the selection signals 171, 170, and 175 in this manner.

On the other hand, the key expansion unit 242 outputs wkey0 as the round key A 162 and wkey10 as the round key B 163 after the key preparation period. Therefore, wkey0 is supplied to the modified round function module 245 at the start of encryption (T17). Upon detecting the start of encryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 242 generates wkey1 using wkey0 held in the round key A register, and wkey1 in the round key A register. Keep it. Therefore, wkey1 is supplied to the modified round function module 245 at timing T18. Round keys are supplied in the same way up to timing T26. At timing T26, wkey10 also serving as round key B 163 is also supplied. When wkey0 is maintained in the round key A register and the round key supply is terminated at timing T26, the key expansion unit 242 keeps wkey0 supplied externally as the encryption key 152 in the round key A register, and then encrypts. To start (T27).

As described above, when the key extension 242 operates, the modified round function module 245 may use the round key in each cycle as shown in FIG.

The operation during the encryption period according to the fifth embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the encryption operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 27A and 27B, encryption of the second block is started at the shortest interval after termination of encryption of the first block. The AES core can achieve its maximum performance by executing encryption of all blocks at this timing. However, the encryption interval can basically be set to any length.

When the encryption of the predetermined number of blocks is completely terminated and the next operation must be executed using another parameter such as an encryption key, the process starts again from the parameter setting.

Next, the decoding operation of the sixth embodiment will be described. 47A and 47B are a timing chart of decoding according to the sixth embodiment. 47A and 47B, the horizontal axis represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis of the left end of FIG. 47A represent signal lines and correspond one-to-one with reference numerals of the signal lines used in FIGS. 44 to 46.

The decoding operation shown in the timing chart of Figs. 47A and 47B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T17) for generating wkey0 and holding it in a register. The third part is the decoding periods T17 to T27 of the first block. The fourth part is the decoding period of the second block (from T27).

The role, start condition, and end condition of the parameter setting period are the same as in encryption of this embodiment. In decryption, however, the encryption / decryption selection signal 153 is asserted. The key preparation period is from T06 to T17, and the start condition and end condition are the same as described in the encryption of this embodiment. The operation of each circuit is almost the same as in the encryption of this embodiment. However, at timing T16, wkey10 is output as the round key B 163. At the end of the key preparation period T17, the control unit 244 asserts the selection signal 175.

The first block decryption period is from T17 to T27, and its start condition and end condition are the same as in the encryption of the present embodiment. The operation of each circuit is also almost the same as described above.

The control unit 244 asserts the selection signal 170 in the final cycle T16 of decoding and negates it in the first cycle T18 or T28 of decoding. The control unit 244 also asserts the selection signal 175 at the end of decoding (T17) and negates it at the end of decoding (T17). The control unit 244 also asserts the selection signal 171 in the first cycle of decryption and negates it at the end of decryption.

 As described with respect to the circuit configuration, when the selection signal 171 is gated, the selector 109 selects the input signal 150. When select signal 171 is asserted, selector 109 selects the output of data retainer 108. When select signal 175 is negated, selector 137 selects and outputs the output of MixColumns / InvMixColumns conversion module 224. When the selection signal 175 is asserted, the selector 137 selects and outputs an input signal 165. When the selection signal 170 is negated, the selector 115 selects and outputs the output of the ShiftRows / InvShiftRows conversion module 223. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114.

Therefore, in the 0 th cycle T17 to T18, the modified round function module 245 performs AddRoundKey transformation, InvShiftRows transformation, and InvSubBytes transformation on the input signal 150. From the first cycle, the modified round function module outputs the result obtained by executing AddRoundKey transformation, InvMixColumns transformation, InvShiftRows transformation, and InvSubBytes transformation on the result of the previous cycle. In the ninth cycle (T26 to T27), the modified round function module outputs the result obtained by executing AddRoundKey transformation, InvMixColumns transformation, InvShiftRows transformation, InvSubBytes transformation, and AddRoundKey transformation.

By controlling the selection signals 171, 170, and 175 in the above-described manner, the modified round function module 245 can execute decryption as shown in FIG. 42.

On the other hand, the key expansion unit 242 outputs wkey10 as the round key A 162 and wkey0 as the round key B 163 after the key preparation period. Therefore, wkey10 is supplied to the modified round function module 245 at the start of decryption (T17). Upon detecting the start of decryption based on the encryption / decryption start signal 158 (T17), the key expansion unit 242 generates wkey9 'using wkey10' held in the round key A register, and round key A register. Keep wkey9 'on Thus, wkey9 'is supplied to the modified round function module 245 at T18. In the same way, wkey9 'is supplied at T19, wkey8' is supplied at T20, and wkey1 'is supplied at T26. The wkey0 necessary for the processing of the last cycle continues to be supplied as the round key B 163.

When the round key supply ends at T26, the key expansion unit 242 generates wkey9 'using wkey10 held in the internal register of the key expansion unit 242, and in the next cycle T27 to the round key A register. Hold wkey9 'and prepare to start the next decryption.

Operation during the decoding period according to the sixth embodiment is performed by the above method. The decoding operation of the second block is performed in the same manner as for the first block. After that, the decoding operation is repeatedly performed as many as a predetermined number of blocks. In the timing charts of Figs. 47A and 47B, decoding of the second block is started at the shortest interval after completion of decoding of the first block. The AES core can achieve its maximum performance by executing decryption of all blocks at this timing. However, the decryption interval can basically be set to any length.

When the decryption of the predetermined number of blocks is completely terminated and the next operation is to be executed using another parameter such as an encryption key, the process starts again from the parameter setting.

The sixth embodiment can be implemented in this way. In the sixth embodiment, the maximum of the sum of the signal processing times for each subblock transform that must be executed in one cycle is somewhat increased. However, this is not a problem in most cases since the maximum of the summation of the signal processing times for each subblock conversion within each clock cycle period is sometimes set with sufficient margin for one cycle time. Thus, in most cases, the number of clock cycles required for AES encryption can be reduced by one cycle. This increases the AES processing speed by about 10%.

The sixth embodiment is merely an example of the present invention, and the effects of the present invention are not limited to the above embodiment.

Seventh Example

In the first to sixth embodiments, a process in which two clock cycles are required if the maximum value of the sum of the signal processing times for each subblock conversion within each clock cycle period is less than or equal to 1/2 of one cycle time. The processing speed can be increased by implementing a to run in one clock cycle. In the seventh embodiment, an example of implementing the speed up method will be described taking the first embodiment as an example.

A configuration related to encryption of the encryption / decryption circuit according to the seventh embodiment includes a first modified round function module, a second modified round function module, and a data holding part. The first modified round function module includes a first AddRoundKey transform module, a first ShiftRows transform module, a first SubBytes transform module, a first MixColumns transform module, and a second AddRoundKey transform module. The second modified round function module includes a third AddRoundKey transform module, a second ShiftRows transform module, a second SubBytes transform module, and a second MixColumns transform module.

A configuration related to decryption of the encryption / decryption circuit according to the seventh embodiment includes a first modified round function module, a second modified round function module, and a data holding unit. The first modified round function module includes a first AddRoundKey transform module, a first InvShiftRows transform module, a first InvSubBytes transform module, a first InvMixColumns transform module, and a second AddRoundKey transform module. The second modified round function module includes a third AddRoundKey transform module, a second InvShiftRows transform module, a second InvSubBytes transform module, and a second InvMixColumns transform module.

The configuration of encryption and decryption will become apparent from the following description.

Fig. 48 shows a comparison between the contents of encryption executed in the clock cycle of the seventh embodiment and the prior art.

Referring to Fig. 48, the clock count indicates a clock cycle count that is "0" at the start of the AES process. Round key wkeyi (i is the number of rounds) is the round key described in FIPS197.

In the seventh embodiment, in the 0th to 3rd cycles, the first AddRoundKey transformation, the first SubBytes transformation, the first ShiftRows transformation, the first MixColumns transformation, the second AddRoundKey transformation, the second SubBytes transformation, the second ShiftRows transformation, And a second MixColumns transformation is performed. In a fourth cycle, a first AddRoundKey transform, a first SubBytes transform, a first ShiftRows transform, a first MixColumns transform, a second AddRoundKey transform, a second ShiftRows transform, a second SubBytes transform, and a third AddRoundKey transform are executed.

 As the round key, wkey0 and wkey1 are used in the 0th cycle, wkey2 and wkey3 are used in the first cycle, ..., wkey8, wkey9, and wkey10 are used in the fourth cycle.

In the seventh embodiment, the same processing as in the prior art is executed as a whole. However, in the seventh embodiment, AES encryption can be executed in clock cycles fewer by one. Next, the sum of the encryption processing time for each subblock conversion within each clock cycle period will be described according to the seventh embodiment. FIG. 49 shows a comparison between the sum of encryption processing times for each subblock transformation executed in the clock cycle of the prior art and the seventh embodiment. FIG. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement the seventh embodiment, the maximum of the sum of the signal processing times for each subblock conversion within each clock cycle period must be less than one clock cycle time. As shown in Fig. 49, the processing time of each subblock transform has the longest SubBytes transform, and is short in the order of MixColumns transform, AddRoundKey transform, and ShiftRows transform.

In the seventh embodiment, the first AddRoundKey transformation, the first SubBytes transformation, the first ShiftRows transformation, the first MixColumns transformation, the second AddRoundKey transformation, the second SubBytes transformation, the second ShiftRows transformation, and the second MixColumns transformation are performed. The sum of the signal processing times for each subblock transform in the 0th to 3rd cycles is the first AddRoundKey transform, the first SubBytes transform, the first ShiftRows transform, the first MixClumns transform, the second AddRoundKey transform, and the second ShiftRows transform. Is longer than the sum of the signal processing time for each subblock transform in the fourth cycle in which the second SubBytes transform, and the third AddRoundKey transform are performed. Therefore, in the seventh embodiment, the maximum value of the sum of the signal processing times for each subblock transform executed in one cycle is the same as in the prior art. The seventh embodiment can also be implemented if the maximum value of the sum of the signal processing times for each subblock transformation within one cycle period is shorter than one cycle time in the prior art.

The present invention is also applicable to AES decoding.

Fig. 50 shows a comparison between the processing contents of the decoding executed in the clock cycle of the seventh embodiment and the prior art. Referring to Fig. 50, the cycle count indicates a clock cycle count that is "0" at the start of the AES process.

In the seventh embodiment, in the 0th cycle, the first AddRoundKey transformation, the first InvShiftRows transformation, the first InvSubBytes transformation, the second AddRoundKey transformation, the first InvMixColumns transformation, and the second InvShiftRows transformation, and the second InvSubBytes transformation, and the first 3 The AddRoundKey transformation is performed. In the first to fourth cycles, the first InvMixColumns transformation, the first InvShiftRows transformation, the first InvSubBytes transformation, the first AddRoundKey transformation, the second InvMixColumns transformation, the second InvShiftRows transformation, the second InvSubBytes transformation, and the second AddRoundKey transformation are executed. do. As the round key, wkey10, wkey9, and wkey8 in the 0th cycle, wkey7 and wkey6 in the 1st cycle, wkey5 and wkey4 in the second cycle, ..., wkey1 and wkey0 in the fourth cycle are used.

In the seventh embodiment, the same processing as in the prior art is executed as a whole. However, in the seventh embodiment, AES decryption can be executed in clock cycles fewer by one.

Next, the sum of the decoding processing time for each subblock conversion within each clock cycle period will be described according to the seventh embodiment. FIG. 51 is a diagram showing the sum of the decoding processing time for each subblock transformation within each clock cycle period in the seventh embodiment and comparison with the prior art. FIG. The vertical axis represents time. The longer the bar, the longer the processing time. In order to implement the seventh embodiment, the maximum of the sum of the signal processing times of each subblock conversion within each clock cycle period must be less than one clock cycle time. As shown in Fig. 51, the processing time of each subblock transform is the longest in InvSubBytes transform, and is short in the order of InvMixColumns transform, AddRoundKey transform, and InvShiftRows transform.

In a seventh embodiment, a first InvMaxColumns transformation, a first InvShiftRows transformation, a first InvSubBytes transformation, a first AddRoundKey transformation, a second InvMixColumns transformation, a second InvShiftRows transformation, a second InvSubBytes transformation, and a second AddRoundKey transformation are performed. The sum of the signal processing times for each subblock transformation of each of the first to fourth cycles includes a first AddRoundKey transformation, a first InvShiftRows transformation, a first InvSubBytes transformation, a second AddRoundKey transformation, a second InvMixClumns transformation, and a second InvShiftRows transformation Is longer than the sum of the signal processing times for each subblock transform in the 0th cycle in which the second InvSubBytes transform and the third AddRoundKey transform are performed. Therefore, in the seventh embodiment, the maximum value of the sum of the signal processing times for each subblock transform executed in one cycle is the same as in the prior art. If the maximum value of the summation of the signal processing times for each subblock transformation within one cycle period is shorter than one cycle time in the prior art, the seventh embodiment can also be implemented.

The features of this embodiment are summarized.

In a conventional general implementation method, the round function defined by the specification is regarded as a break in processing, so that encryption and decryption are distributed among clock cycles. Thus, the sum of the signal processing times for each subblock transform in each cycle changes. In addition, as described in the first embodiment, eleven cycles, that is, odd cycles, are required for processing. If two cycles of processing are performed in one cycle, one cycle of processing remains as a segment. As a result, the process requires six cycles.

On the other hand, in the present invention, AES processing requires 10 cycles. Even if two cycles of processing are performed in one cycle, no segment remains. As in the seventh embodiment, when two cycles of processing are executed in one cycle, the reduction of one cycle increases the AES processing speed by about 20%.

Next, a circuit configuration of the AES core for implementing AES encryption and decryption will be described.

52 is a block diagram of an AES Core according to the seventh embodiment.

Referring to Fig. 52, AES Core 401 executes AES processing. The key expansion unit 402 generates and outputs a round key for AES encryption and decryption from the encryption key. The encryption / decryption section 403 performs encryption of 128-bit plain text data or decryption of 128-bit cipher text data using the round key supplied from the key expansion section 402. The control unit 404 receives a control signal from a unit external to the AES core 401 to control signals of the key expansion unit 402 and the encryption / decryption unit 403 and external to the AES core 401. Generate a signal to notify the unit of completion of the operation.

Referring to FIG. 52, the round key A1 462 is one of the round keys generated by the key extension 402. Round key A2 463 is one of the round keys generated by key extension 402.

The components and signal lines of FIG. 52 are referred to by the same reference numerals as in the first embodiment, and description thereof is omitted.

In the above configuration, the round key A1 462 is input to the encryption / decryption unit 403 from the key expansion unit 402, and the round key A2 463 is encrypted / decryption unit 403 from the key expansion unit 402. ) Is entered.

Next, the encryption / decryption unit 403 will be described. 53 is a block diagram of the encryption / decryption unit 403. Referring to FIG. 53, the modified round function module 405 executes encryption using the round key A1 462. The modified round function module 407 performs encryption using the round key A2 463 and the round key B 163 under the control of the selection signal 170. The modified round function module 406 performs decryption using the round key A1 462 and the round key B 163 under the control of the selection signal 170. The modified round function module 408 executes decryption using the round key A2 463.

Referring to FIG. 53, the modified round function module 407 receives an input signal 475. Modified round function module 408 receives input signal 476. Components and signal lines of FIG. 53 are referred to with the same reference numerals as in the first embodiment, and description thereof is omitted.

54A is a block diagram of a modified round function module 405. 54B is a block diagram of a modified round function module 407.

A modified round function module 405 will be described with reference to FIG. 54A. Referring to FIG. 54A, the AddRoundKey conversion module 110 receives an input signal 165 and a round key A1 462 to perform AddRoundKey conversion. The SubBytes conversion module 111 receives the output of the AddRoundKey conversion module 110 and performs SubBytes conversion. The ShiftRows conversion module 112 receives the output of the SubBytes conversion module 111 and executes ShiftRows conversion. The MixColumns conversion module 113 receives the output of the ShiftRows conversion module 112 and executes MixColumns conversion. The output signal of the MixColumns transformation module 113 is the output of the modified round function module 405.

A modified round function module 407 will be described with reference to FIG. 54B. Referring to FIG. 54B, the AddRoundKey conversion module 110 receives an input signal 475 and a round key A2 463 to execute AddRoundKey conversion. The SubBytes conversion module 111 receives the output of the AddRoundKey conversion module 110 and performs SubBytes conversion. The ShiftRows conversion module 112 receives the output of the SubBytes conversion module 111 and executes ShiftRows conversion. The MixColumns conversion module 113 receives the output of the ShiftRows conversion module 112 and executes MixColumns conversion. The AddRoundKey conversion module 114 receives the output of the ShiftRows conversion module 112 and the round key B 163 to execute AddRoundKey conversion. The selector 115 selects and outputs one of the output of the MixColumns conversion module 113 and the output of the AddRoundKey conversion module 114 according to the selection signal 170. The output signal of the selector 115 is the output of the modified round function module 407.

Here, the names of the above-described transforms are the same as those of the subblock transform of the AES process described in FIPS197.

In the above configuration, when the selection signal 170 is negated, the selector 115 selects and outputs the output of the MixColumns conversion module 113. When the selection signal 170 is asserted, the selector 115 selects and outputs the output of the AddRoundKey conversion module 114.

Next, the modified round function modules 406 and 408 will be described with reference to FIGS. 55A and 55B. 55A is a block diagram of a modified round function module 406.

Referring to FIG. 55A, the InvMixColumns transformation module 116 receives an input signal 165 and performs InvMixColumns transformation. The AddRoundKey conversion module 121 receives the input signal 165 and the round key B 163 and performs AddRoundKey conversion. The selector 118 selects and outputs one of an output of the InvMixColumns conversion module 116 and an AddRoundKey conversion module 121 according to the selection signal 170. The InvShiftRows transformation module 119 receives the output of the selector 118 and executes InvShiftRows transformation. The InvSubBytes conversion module 120 receives the output of the InvShiftRow conversion module 119 and performs InvSubBytes conversion. The AddRoundKey conversion module 117 receives the output of the InvSubBytes conversion module 120 and the round key A1 462 to execute AddRoundKey conversion. The output of the AddRoundKey conversion module 117 is the output of the modified round function module 406.

Here, the names of the transformations are the same as the subblock transformations of the AES process described in FIPS197.

In the above configuration, when the selection signal 170 is negated, the selector 118 selects and outputs the result of the InvMixColumns conversion module 116. When the selection signal 170 is asserted, the selector 118 selects and outputs the output of the AddRoundKey conversion module 121.

Next, the modified round function module 408 will be described with reference to the block diagram of FIG. 55B.

Referring to FIG. 55B, the InvMixColumns transformation module 116 receives an input signal 476 and performs InvMixColumns transformation. The InvShiftRows conversion module 119 receives the output of the InvMixColumns conversion module 116 and executes InvShiftRows conversion. The InSubBytes conversion module 120 receives the output of the InvShiftRows conversion module 119 and executes InvSubBytes conversion. The AddRoundKey conversion module 117 receives the output of the InvSubBytes conversion module 120 and the round key A2 463 to execute AddRoundKey conversion. The output of the AddRoundKey conversion module 117 is the output of the modified round function module 408.

Here, the names of the transformations are the same as the subblock transformations of the AES process described in FIPS197.

Next, the operation of encryption of the above configuration will be described in detail with reference to the timing charts of Figs. 56A and 56B.

Referring to Figs. 56A and 56B, the horizontal axis represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. The three digits on the vertical axis at the left end of Fig. 56A represent signal lines and correspond one-to-one to the reference numbers of the signal lines used in Figs. 52 to 55B.

The encryption operation shown in the timing chart of Figs. 56A and 56B is roughly divided into four parts. The first part is parameter setting periods T01 to T06 for setting various parameters such as encryption keys. The second part is a key preparation period (T06 to T12) for generating wkey0 and holding it in a register. The third part is the encryption period T12 to T17 of the first block. The fourth part is the encryption period of the second block (T17 to T22).

In the parameter setting, in addition to the encryption key 152 and the encryption / decryption selection signal 153, various parameters for encryption / decryption such as key length and encryption mode are set as necessary. The parameter setting period is a period having an arbitrary length immediately after reset. When the key preparation start signal 155 is asserted from a unit external to the AES core 401 (T06), the parameter setting period ends.

At the same time as the end of the parameter setting period, the next key preparation period starts. In the key preparation period, the key extension generates a round key in advance. The key preparation period is a period from the time the key preparation start signal 155 is asserted (T06) to the timing T12 after six cycles in which the last round key wkey10 is generated.

Next, the operation of each circuit during the key preparation period will be described. The key expansion unit 402 generates wkey1 using wkey0 as the encryption key 152 already in the key preparation period. At the same time as the key preparation start signal 155 is asserted, wkey1 is held in the register of the round key A2 463 and output. As the key preparation start signal 155 is asserted, the controller 404 counts up the counter signal 161 in order from zero. At T07, key extension 402 performs key expansion using wkey1 held as round key A2 463 to generate wkey2 and wkey3, and round them to round key A1 462 and round key A2 463. As output. In the next cycle T08, the key extension generates wkey4 and wkey5 using wkey3 output as round key A2 463, and outputs them as round key A1 462 and round key A2 463, respectively. As the round key A1 462 and the round key A2 463, the round keys are generated in the same manner so that wkey6 and wkey7 at timing T09 and wkey8 and wkey9 are output at timing T10, respectively. At timing T11, the key expansion unit 402 generates wkey10 using wkey9 output as the round key A2 463, and outputs wkey10 as the round key B 163. Thereafter, wkey10 continues to be output as the round key B 163 until key preparation is executed again.

At the end of the key preparation period (T12), the key expansion unit 402 generates wkey1 using wkey0 supplied as the encryption key 152, and encrypts it as the round key A1 462 and the round key A2 463, respectively. Print the first round keys wkey0 and wkey1 to be used for / decryption. The values of the round key A1 462 and the round key A2 463 are maintained until the encryption / decryption start signal 158 is asserted. The control unit 404 stops counting up the counter signal 161 and clears the counter to zero.

Near the end of the key preparation period, more specifically, in the fifth cycle T11 after the start of the key preparation, the key preparation is ended in the next cycle T12, in which the control unit 404 anticipates that the encryption is valid, and the control unit 404 controls the control signal. Assert (157).

When the control signal 157 is detected at timing T12, the input signal supply unit disposed outside the AES core 401 supplies the plain text data P0 to the AES core 401 as the input signal 150. The encryption / decryption start signal 158 is asserted (T12) to initiate encryption of the input signal 150. In the timing chart, the encryption / decryption start signal 158 is asserted in the shortest cycle. However, the timing is freely determined outside the AES core 401.

In the encryption period, the input signal 150 is encrypted. The encryption period is a period from when the encryption / decryption start signal 158 is asserted (T12) to a timing T17 five cycles later.

Upon detecting that the encryption / decryption start signal 158 is asserted, the control unit 404 negates the control signal 157, the valid signal 159, and the output holding control signal 160 in the next cycle T13. Let's do it. At the same time, the control unit 404 starts to count up the counter signal 161.

The key expansion unit 402 generates a round key as in the key preparation period, and outputs wkey0 at the timing T12, wkey2 at the timing T13, ... wkey8 at the timing T16 as the round key A1 462. The key expansion unit 402 outputs wkey1 at the timing T12, wkey3 at the timing T13, ... wkey9 at the timing T16 as the round key A2 463. As shown in FIG.

From T12 to T13, the select signal 171 is negated. Therefore, the modified round function module 405 performs subblock conversion on the input signal 150 using wkey0 output as the round key A1. From T13 to T17, the selection signal 171 is asserted. Therefore, the modified round function module 405 performs subblock conversion using wkey2 from T13 to T14, wkey4 from T14 to T15, and wkey6 from T15 to T16 with respect to the output signal of the data holding unit 108. Run

On the other hand, the modified round function module 407 serves the input signal 475 using wkey1 at T12 to T13, wkey3 at T13 to T14, wkey5 at T14 to T15, ..., and wkey7 at T15 to T16. Perform a block transform.

In the final cycle of encryption T16, the control unit 404 asserts the selection signal 170. Accordingly, the selector 115 of the modified round function module 407 selects and outputs the output of the AddRoundKey conversion module 114 that executes the AddRoundKey conversion using the round key B 163 to convert the subblock of the final cycle. Is executed. At T16, the output signal 166 of the modified round function module 407 outputs the ciphertext data C0 that is the result of the encryption of the plain text data P0 as an input signal. After one cycle (T17), the data holding unit 108 outputs the value of the ciphertext data C0 to the outside as the output of the AES core 401. At the same time, the control unit 404 asserts the valid signal 159 in order to notify that the unit outside the AES core 401 is encrypted and the output signal 151 is valid (T17). While the valid signal 159 is asserted, the AES core 401 ensures that the output signal 151 is valid.

On the other hand, the control signal 160 remains asserted because the valid signal 159 is asserted at T17, but the encryption / decryption start signal 158 is also asserted at T17. If the encryption / decryption start signal 158 is not asserted at T17, the control signal 160 is asserted at T17, and the value of the data holding unit 108 holds the ciphertext data C0.

At T17 when the encryption ends, the key expansion unit 402 outputs wkey0 as the round key A1 462 and wkey1 as the round key A2 463. The values of the round key A1 462 and the round key A2 463 are maintained until the next encryption / decryption start signal 156 is asserted.

In anticipation of the end of encryption (T17), the control unit 404 asserts the control signal 157 before the completion of the cycle (T16). When the control signal 157 is asserted, a unit outside the AES core 401 sets the value of the input signal 150 to the next plain text data P1 so that encryption of the second block can start. . In the timing charts of FIGS. 56A and 56B, the external unit of the AES core 401 asserts the next encryption / decryption start signal in the shortest cycle T17. The second block encryption period is from T17 to T22, and the same operation as that of the first block is performed. Thereafter, the encryption operation is repeatedly performed for a predetermined number of blocks. In the timing charts of Figs. 56A and 56B, encryption of the second block is started at the shortest interval from the end of encryption of the first block. The AES core can achieve maximum performance by executing encryption of all blocks at this timing. However, the encryption interval can basically be set to any length.

When the encryption of the predetermined number of blocks is completely terminated and the next operation is to be performed using another parameter such as an encryption key, the process starts again from the parameter setting.

Next, the decoding operation of the seventh embodiment will be described. 57A and 57B are a timing chart of decoding according to the seventh embodiment. Referring to Figs. 57A and 57B, the horizontal axis represents time. Timing names T01, T02, ..., T33 are assigned to the leading edge of the clock pulse. Three digits on the vertical axis of the left end of FIG. 57A represent signal lines and correspond one-to-one with reference numerals of the signal lines used in FIGS. 52 to 55.

The decryption operation is also roughly divided into four parts: parameter setting (T01 to T06), key preparation (T06 to T12), first block decryption (T12 to T17), and second block decryption (from T17).

The role, start condition, and end condition of the parameter setting period are the same as in encryption of this embodiment. However, upon decryption, the encryption / decryption selection signal 153 is asserted.

The key preparation period is from T06 to T12, and its start condition and end condition are the same as in encryption of this embodiment. However, at the end of the key preparation period (T12), the key expansion unit 402 performs key expansion inversely using wkey10 held as the round key B 163, and round key A1 462 and round key, respectively. As A2 463, the first round keys wkey9 and wkey8 to be used in decryption are output. The values of the round key A1 462 and the round key A2 463 are maintained until the encryption / decryption start signal 158 is asserted. The control unit 404 stops counting up the counter signal 161 and clears the counter to zero.

In the vicinity of the key preparation period, the key preparation is terminated at T12, and the control unit 404 asserts the control signal 157 at T11 in anticipation that the decryption is valid.

When the control signal 157 is detected at T12, the input signal supply unit disposed outside the AES core 401 supplies the ciphertext data C0 to the AES core 401 as the input signal 150. The encryption / decryption start signal 158 is asserted to start decrypting the input signal 150 (T12). In the timing chart, the encryption / decryption start signal 158 is asserted in the shortest cycle. However, the timing is freely determined outside the AES core 401.

In the decoding period, the input signal 150 is decoded. The decryption period is a period from when the encryption / decryption start signal 158 is asserted to the timing T17 after five cycles.

Upon detecting that the encryption / decryption start signal 158 is asserted, the controller 404 negates the control signal 157, the output holding signal 159, and the control signal 160 in the next cycle T13. . At the same time, the control unit 404 starts to count up the counter signal 161.

At T13, key extension 402 performs key expansion using wkey8 held as round key A2 463 to generate wkey7 and wkey6 as round key A1 462 and round key A2 463, respectively. Output In the next cycle T14, the key extension generates wkey5 and wkey4 using wkey6 output as round key A2 463, and outputs them as round key A1 462 and round key A2 463, respectively. Round keys are generated in the same way, and wkey3 and wkey2 at T15 and wkey1 and wkey0 at T16 are output as round key A1 462 and round key A2 463, respectively.

In the first cycle T12 of decoding, the control unit 404 negates the selection signal 171. Therefore, the plain text data P0 of the input signal 150 is input to the modified round function module 406. Since the selection signal 170 is asserted, the modified round function module 406 switches the selector 118 to select the output of the AddRoundKey conversion module 121, so that one cycle of decryption is executed. The output of the modified round function module 406 is directly input to the modified round function module 408 so that another cycle of decryption is executed. The output result of the modified round function module 408 is maintained in the data holding unit 108.

In the next cycle T13, the control section 404 asserts the selection signal 171 so that the output of the data holding section is input to the modified round function module 406. Since the select signal 170 is negated, the modified round function module 406 switches the selector 118 to select the output of the InvMixColumns transform module 116, so that one cycle of decoding is performed. The output of the modified round function module 406 is directly input to the input of the modified round function module 408, so that another cycle of decryption is executed. The processing is performed in the same way up to T16. The modified round function module 406 uses wkey 10 and weky9 at T12, wkey7 at T13, wkey5 at T14, and wkey1 at T16 as round keys. The modified round function module 408 uses wkey8 at T12, wkey6 at T13, and wkey0 at T16.

In T16, the output signal 167 of the modified round function module 408 outputs the plain text data P0 which is the result of decryption of the ciphertext data C0 as an input signal. After one cycle (T17), the data holding unit 108 outputs the value of the plain text data P0 to the outside as the output of the AES core 401. At the same time, the control unit 404 asserts the valid signal 159 in order to notify the unit outside the AES core 401 that the output signal 151 is valid (T17). While the valid signal 159 is asserted, the AES core 401 ensures that the output signal 151 is valid.

On the other hand, the control signal 160 remains asserted because the valid signal 159 is asserted at T17, but the encryption / decryption start signal 158 is also asserted at T17. If the encryption / decryption start signal 158 is not asserted at T17, the control signal 160 is asserted at T17, and the value of the data holding unit 108 holds the plain text data P0.

At T17 when the decryption ends, the key expansion unit 402 outputs wkey9 as the round key A1 462 and wkey8 as the round key A2 463. The values of the round key A1 462 and the round key A2 463 are maintained until the next encryption / decryption start signal 156 is asserted.

In anticipation of the end of decoding (T17), the control unit 404 asserts the control signal 157 before completion of the cycle (T16). When the control signal 157 is asserted, the unit outside the AES core 401 sets the value of the input signal 150 to the next ciphertext data C1 so that decryption of the second block can start. do.

The second block encryption period is from T17 to T22, and the same operation as that of the first block is performed. Thereafter, the decoding operation is repeatedly performed for a predetermined number of blocks. In the timing charts of Figs. 57A and 57B, decoding of the second block is started at the shortest interval from the end of decoding of the first block. The AES core can achieve maximum performance by executing the decoding of all blocks at this timing. However, the decryption interval can basically be set to any length.

When the decryption of the predetermined number of blocks is completely terminated and the next operation is to be executed using another parameter such as an encryption key, the process starts again from the parameter setting.

The seventh embodiment can be implemented in this way. In the seventh embodiment, the number of clock cycles required for AES encryption and decryption is reduced by one cycle without increasing the maximum of the sum of signal processing times for each subblock transformation within each clock cycle period. This increases the AES processing speed by about 20%.

The first embodiment has been illustrated above. However, the same implementation is possible for any other embodiment.

The seventh embodiment described above is merely one example of the present invention, and the effects of the present invention are not limited to the above embodiment.

Eighth Embodiment

As a general form of the seventh embodiment, the processing of N cycles of the first embodiment can be executed in one clock cycle. N is a natural number of 2 or more. In the eighth embodiment, a circuit configuration for implementing the present method is described.

In the first embodiment, circuits for executing N cycles of processing in one clock cycle can be classified into two types: the total number of cycles required for processing can be divided into N without the rest, and N If not divided into dogs. For example, for AES-128, the total number of cycles required for processing is 10 (FIG. 1). When N is 2 or 5, it may be classified as the former case and the other case as the latter case.

First, the case where the total number of cycles can be divided by N without a remainder will be described. In this case, N modified round function modules are implemented for each of encryption and decryption as in the seventh embodiment where N = 2 (N is a natural number of two or more). Every clock cycle, processing is performed using all modified round function modules. At this time, the number of clock cycles required for the processing is 10 / N.

In the first embodiment, a circuit configuration of an encryption / decryption section in the case where the total number of cycles can be divided by N without a remainder will be described. 58 is a block diagram of an encryption / decryption unit according to the eighth embodiment. Referring to FIG. 58, reference numeral 503 denotes an encryption / decryption unit, 550 denotes a round key A1, and 551 denotes a round key A2. There are N round keys A, including round key A1 550 and round key A2 551. The same reference numerals as in the seventh embodiment refer to the same components and the same signal lines, and the description thereof is omitted.

In the above configuration, the output of the selector 109 is connected to the modified round function module 405. (N-1) modified round function modules 405 are connected in series. The output of the last modified round function module 405 is connected to the modified round function module 407. The output of the selector 109 is also connected to the modified round function module 406. The output of the modified round function module 406 is connected to the modified round function module 408. The (N-1) modified round function modules 408 are connected in series. The output of the last modified round function module 408 is connected to the selector 107. The modified round function module 405 receives the round key A1 550, the round key A2 551, and the remaining round key A, respectively, in the connection order. The modified round function module 407 receives the N th round key A and the round key B 163. Modified round function module 406 receives round key A1 550 and round key B 163. The modified round function module 408 receives round key A2 551 and remaining round key A, respectively, in concatenated order. Description of the components of FIG. 58 has the same connection relationship with the seventh embodiment, and thus will be omitted.

Next, the case where the total number of cycles in the first embodiment cannot be divided by N without the rest will be described. In this case, N modified round function modules are implemented for each of encryption and decryption. It is also necessary to bypass some modified round function modules in certain cycles of encryption or decryption. For example, when N = 4, in the first embodiment shown in Fig. 1, the processing of the 0th to 3rd cycles is executed in the 0th clock cycle. In the first clock cycle, the processing of the fourth to seventh cycles of the first embodiment of FIG. 1 is executed. In the second clock cycle, the processing of the eighth and ninth cycles of the first embodiment in FIG. 1 is executed. That is, if the total number of cycles cannot be divided by N without the remainder, all four modified round function modules are used in the 0th and 1st clock cycles. In the second clock cycle, however, only two modified round function modules are sufficient. At this time, the number of clock cycles required for the processing is 10 / N (the decimal point is rounded off).

Various circuit configurations are available when the total number of cycles in the first embodiment cannot be divided by N without the rest. For example, a selector is installed to select whether to bypass the modified round function module immediately after each modified round function module shown in FIG. 58, and each selector according to the number of cycles from the start of encryption or decryption. Is switched. The circuit configuration in this case can be easily assumed from Fig. 58, and the block diagram is omitted.

The eighth embodiment can be implemented in the manner described above. According to the first embodiment of the present invention, the total number of clock cycles required for processing is 10 for AES-128, 12 for AES-192, and 14 for AES-256. As described in this embodiment, all the circuits can be implemented by classifying the case where the total number of cycles can be divided by N without a remainder, or can not be divided by N. Circuit configurations that implement all of the AES-128, AES-192, and AES-256 are also possible. In this case, when N = l and N = 2, the total number of cycles required for processing in all of AES-128, AES-192, and AES-256 can be divided by N without remaining. Thus, the circuit can be implemented in this embodiment using an arrangement for the total number of clock cycles that can be divided by N without a remainder. Although N has any other value, any one of N modified round function modules implemented in the encryption / decryption portion, as in the case where the total number of cycles in the first embodiment cannot be divided by N without the rest Using the configuration of this embodiment, which can select the output as the output of the encryption / decryption unit, a circuit for implementing all of AES-128, AES-192, and AES-256 can be formed.

<Example 9>

In the first to sixth embodiments of the present invention, the processing of one clock does not fit in one clock cycle defined in some cases. In this case, a new data holding part is added to the modified round function module, so that one cycle of processing is executed in a plurality of clock cycles in the first to sixth embodiments. As a concrete example, a circuit configuration in which the processing executed in one cycle in the first embodiment is executed in two clock cycles will be described.

59 shows an example in which a new data holding unit is added for the modified round function module of the first embodiment. Referring to Fig. 59, reference numeral 605 denotes a modified round function module, and the data holding unit 608 holds the result of the encryption process.

In the above configuration, the output of the SubBytes conversion module 111 is input to the data holding unit 608. The output of the data holding unit 608 is input to the ShiftRows conversion module 112.

Adding a new data holding part to the encryption part makes it possible to execute the processing of one cycle of the first embodiment in two clock cycles. In FIG. 59, the data holding unit 608 is added between the SubBytes conversion module 111 and the ShiftRows conversion module 112. In FIG. However, the data holding portion may be connected at any point. Alternatively, the SubBytes conversion module 111 may include a data retainer.

In the above example, two clock cycles are required for the processing of one cycle of the first embodiment. However, processing can be done in N clock cycles. In this case, the data holding part is added to (N-1) new points at arbitrary points between the conversion modules, or implemented in the conversion modules.

The first embodiment has been described above. However, the same implementation is possible for any other embodiment.

<Example 10>

In the first to ninth embodiments of the present invention, the data update period of the data holding unit is one clock cycle. However, this is not necessarily the case.

In general, the frequency of the operating clock of the CPU or DMA is mostly high. If the data retainer for encryption uses the same clock, it is possible to ensure the sum of the signal processing times for each subblock conversion within each clock cycle period, and the processing may not fit in one clock cycle.

In this case, for example, if the sum of the signal processing times for each subblock conversion within each clock cycle period is twice or less than one clock cycle, the data update of the data holding part may be performed once in two clock cycles. Can be.

Such a configuration can be easily implemented by newly inputting an enable signal to the data holding unit.

This embodiment will be described with reference to the timing charts of Figs. 61A and 61B. Fig. 61A shows a timing chart when the update of the data holding unit is synchronized with the clock cycle. In synchronization with the falling edge of the clock cycle, the data holding portion updates the data.

61B shows a timing chart when the update of the data holding unit is not synchronized with the clock cycle. The enable signal is input to the data holding portion to repeat High and Low in one half of the clock. Only when the enable signal is High, the data holding unit performs data update. Thus, the data holding portion updates data once in two clock cycles on the falling edge of the clock.

In this case, processing of one clock is executed in two clock cycles.

In the example described in this embodiment, one cycle of processing is executed in two clock cycles. However, it goes without saying that processing of one cycle can be executed in N clock cycles.

In the first to ninth embodiments of this embodiment, N clock cycles may be defined as one cycle.

The embodiments of the present invention have been described above. In each example, AES-128 is taken as an example. However, AES-192 and AES-256 may also be implemented. The difference from the embodiment of AES-128 is the number of bits of the encryption key input to the key expansion unit, the number of round keys generated by the key expansion unit, and the assert / nigate timing of the control signal. These can be easily implemented based on the same concept as described in each embodiment. The encryption / decryption unit and the modified round function module do not require any changes from those described in the embodiment of AES-128.

While the invention has been described with reference to exemplary embodiments, it will be understood that the invention is not limited to the disclosed embodiments. The scope of the following claims is to be accorded the broadest interpretation so as to encompass all such modifications and equivalent structures and functions.

1 compares the processing contents of encryption executed in clock cycles of the prior art with the first embodiment.

Fig. 2 is a comparison of the sum of encryption processing times for each subblock transformation within each clock cycle period of the prior art compared with the first embodiment.

Fig. 3 is a diagram comparing the processing contents of decryption executed in clock cycles of the prior art with the first embodiment.

Fig. 4 is a comparison of the sum of the decoding processing times for each subblock transformation within each clock cycle period of the prior art compared with the first embodiment.

5 is a block diagram of an AES core according to the first embodiment.

6 is a block diagram of an encryption / decryption unit according to the first embodiment.

Fig. 7 is a block diagram of a modified round function module for encryption according to the first embodiment.

8 is a block diagram of a modified round function module for decryption according to the first embodiment;

9A and 9B are a timing chart of encryption according to the first embodiment.

10A and 10B are a timing chart of decoding according to the first embodiment.

Fig. 11 shows the processing contents of encryption and decryption executed in clock cycles according to the second embodiment.

Fig. 12 is a view comparing the sum of encryption processing times for each subblock transformation within each clock cycle period of the prior art with the second embodiment.

Fig. 13 is a view comparing the sum of decoding processing times for each subblock transformation within each clock cycle period of the prior art with the second embodiment.

14 is a block diagram of an AES core according to the second embodiment.

Fig. 15 is a block diagram of an encryption / decryption unit according to the second embodiment.

Fig. 16 is a block diagram of a modified round function module for encryption according to the second embodiment.

Fig. 17 is a block diagram of a modified round function module for decryption according to the first embodiment.

18A and 18B are a timing chart of encryption according to the second embodiment.

19A and 19B are a timing chart of decoding according to the second embodiment.

20 is a diagram showing processing contents of encryption and decryption executed in clock cycles according to the third embodiment.

Fig. 21 is a comparison of the sum of encryption processing times for each subblock transformation within each clock cycle period of the prior art with the third embodiment.

Fig. 22 is a comparison of the sum of decoding processing times for each subblock transformation within each clock cycle period of the prior art compared with the third embodiment;

Fig. 23 is a block diagram of an AES core according to the third embodiment.

Fig. 24 is a block diagram of an encryption / decryption unit according to the third embodiment.

Fig. 25 is a block diagram of a modified round function module for encryption according to the third embodiment.

Fig. 26 is a block diagram of a modified round function module for decryption according to the third embodiment.

27A and 27B are a timing chart of encryption according to the third embodiment.

28A and 28B are a timing chart of decoding according to the third embodiment.

Fig. 29 is a comparison of the processing contents of encryption executed in clock cycles of the prior art with the fourth embodiment.

Fig. 30 is a comparison of the processing contents of decryption executed in clock cycles of the prior art with the fourth embodiment.

FIG. 31 is a comparison of the sum of signal processing time for each subblock transformation executed in clock cycles of the prior art with the fourth embodiment. FIG.

32 is a block diagram of an AES core according to a fourth embodiment.

Fig. 33 is a block diagram of an encryption / decryption unit according to the fourth embodiment.

34 is a block diagram of a modified round function module according to the fourth embodiment.

35A and 35B are a timing chart of decoding according to the fourth embodiment.

Fig. 36 shows the processing contents of encryption and decryption executed in clock cycles according to the fifth embodiment.

FIG. 37 compares the sum of signal processing time for each subblock transformation executed in clock cycles of the prior art with the fifth embodiment; FIG.

38 is a block diagram of an AES core according to a fifth embodiment.

Fig. 39 is a block diagram of an encryption / decryption unit according to the fifth embodiment.

40 is a block diagram of a modified round function module according to the fifth embodiment.

41A and 41B are a timing chart of decoding according to the fifth embodiment.

Fig. 42 is a diagram showing processing contents of encryption and decryption executed in clock cycles according to the sixth embodiment.

FIG. 43 is a comparison of the sum of signal processing time for each subblock transformation executed in clock cycles of the prior art with the sixth embodiment; FIG.

44 is a block diagram of an AES core according to the sixth embodiment.

45 is a block diagram of an encryption / decryption unit according to the sixth embodiment.

46 is a block diagram of a modified round function module according to the sixth embodiment.

47A and 47B are a timing chart of decoding according to the sixth embodiment.

Fig. 48 is a comparison of the processing contents of encryption executed in clock cycles of the prior art with the seventh embodiment.

Fig. 49 is a comparison of the sum of encryption processing times for each subblock transformation within each clock cycle period of the prior art with the seventh embodiment.

Fig. 50 is a diagram comparing the processing content of decryption executed in clock cycles of the prior art with the seventh embodiment.

Fig. 51 is a comparison of the sum of the decoding processing times for each subblock transformation within each clock cycle period of the prior art with the seventh embodiment;

52 is a block diagram of an AES Core according to the seventh embodiment.

Fig. 53 is a block diagram of an encryption / decryption unit according to the seventh embodiment.

54A and 54B are block diagrams of a modified round function module for encryption according to a seventh embodiment.

55A and 55B are block diagrams of a modified round function module for decryption according to the seventh embodiment.

56A and 56B are a timing chart of encryption according to the seventh embodiment.

57A and 57B are a timing chart of decoding according to the seventh embodiment.

58 is a block diagram of an encryption / decryption unit according to the eighth embodiment.

59 is a block diagram of a modified round function module according to the ninth embodiment.

60A and 60B illustrate an algorithm of AES.

61A and 61B are timing charts showing data update timings of a clock and data holding unit.

62 illustrates yet another implementation method.

<Explanation of symbols for main parts of the drawings>

107, 109, 137, 115: selector

108: data holding unit

142, 232: key extension

143, 233: encryption / decryption unit

135, 136, 145, 146: modified round function module

144, 234: control unit

110, 114, 117, 121: AddRoundKey Conversion Module

111: SubBytes Conversion Module

112: ShiftRows transformation module

113: MixColumns transformation module

120: InvSubBytes Conversion Module

119: InvShiftRows Conversion Module

116: InvMixColumns Conversion Module

222: SubBytes / InvSubBytes Conversion Module

223: ShiftRows / InvShiftRows transformation module

224: MixColumns / InvMixColumns Conversion Module

Claims (12)

AES encryption / decryption circuit, A first AddRoundKey conversion module; A second AddRoundKey conversion module; ShiftRows conversion module; SubBytes conversion module; MixColumns conversion module; And Data holding unit Including; AES encryption / decryption circuitry, in the cycle of encryption, executing the first AddRoundKey conversion module and the second AddRoundKey conversion module using different round keys. The method of claim 1, A key expansion unit for generating a round key from an encryption key and supplying the round key to the AddRoundKey conversion module; And A control unit for generating a control signal for executing the encryption by counting clock cycles from the start of encryption AES encryption / decryption circuit further comprising. The method of claim 1, In the first clock cycle of encryption, the result obtained by performing AddRoundKey conversion, SubBytes conversion, ShiftRows conversion, and MixColumns conversion on the plain text data is output to the data holding unit. From the second clock cycle to the (NR-1) th clock cycle, where NR is the number of rounds, the result obtained by executing AddRoundKey conversion, SubBytes conversion, ShiftRows conversion, and MixColumns conversion is performed on the output data of the data holding unit. Output to the data holding part, And an AES encryption / decryption circuit for outputting the result obtained by performing a first AddRoundKey conversion, SubBytes conversion, ShiftRows conversion, and second AddRoundKey conversion on the output data of the data holding unit in the NRth clock cycle. The method of claim 1, In the first clock cycle of encryption, a result obtained by performing a first AddRoundKey transformation, SubBytes transformation, ShiftRows transformation, MixColumns transformation, and a second AddRoundKey transformation on the plain text data is output to the data holding unit, From the second clock cycle to the (NR-1) th clock cycle (where NR is the number of rounds), the result obtained by performing SubBytes transformation, ShiftRows transformation, MixColumns transformation, and AddRoundKey transformation is performed on the output data of the data holding unit. Output to the data holding part, And an AES encryption / decryption circuit for outputting the result obtained by performing SubBytes conversion, ShiftRows conversion, and AddRoundKey conversion on the output data of the data holding unit in the NRth clock cycle. The method of claim 1, In the first clock cycle of encryption, the result obtained by performing AddRoundKey conversion, SubBytes conversion, and ShiftRows conversion on the plain text data is output to the data holding unit. From the second clock cycle to the (NR-1) th clock cycle (where NR is the number of rounds), the result obtained by performing MixColumns transformation, AddRoundKey transformation, SubBytes transformation, and ShiftRows transformation on the output data of the data holding section is stored. Output to the data holding part, In the NRth clock cycle, AES encryption / decryption outputting the result obtained by performing MixColumns conversion, first AddRoundKey conversion, SubBytes conversion, ShiftRows conversion, and second AddRoundKey conversion on the output data of the data holding part. Circuit. AES encryption / decryption circuit, A first AddRoundKey conversion module; A second AddRoundKey conversion module; InvShiftRows transformation module; InvSubBytes Conversion Module; InvMixColumns transformation module; And Data holding unit Including; AES encryption / decryption circuitry, in the cycle of decryption, executing the first AddRoundKey transform module and the second AddRoundKey transform module using different round keys. The method of claim 6, In the first clock cycle of decryption, a result obtained by performing a first AddRoundKey transformation, an InvShiftRows transformation, an InvSubBytes transformation, and a second AddRoundKey transformation on the ciphertext data is output to the data holding unit, From the second clock cycle to the (NR-1) th clock cycle (where NR is the number of rounds), the result obtained by executing InvMixColumns transformation, InvShiftRows transformation, InvSubBytes transformation, and AddRoundKey transformation is performed on the output data of the data holding unit. Output to the data holding part, An AES encryption / decryption circuit for outputting the result obtained by performing InvMixColumns conversion, InvShiftRows conversion, InvSubBytes conversion, and AddRoundKey conversion on the output data of the data holding unit in the NRth clock cycle. The method of claim 6, In the first clock cycle of decryption, the result obtained by performing AddRoundKey conversion, InvSubBytes conversion, InvShiftRows conversion, and InvMixColumns conversion on the ciphertext data is output to the data holding unit. From the second clock cycle to the (NR-1) th clock cycle (where NR is the number of rounds), the result obtained by executing AddRoundKey conversion, InvSubBytes conversion, InvShiftRows conversion, and InvMixColumns conversion on the output data of the data holding unit is described. Output to the data holding part, And an AES encryption / decryption circuit for outputting the result obtained by performing a first AddRoundKey transformation, an InvSubBytes transformation, an InvShiftRows transformation, and a second AddRoundKey transformation on the output data of the data holding portion in an NRth clock cycle. AES encryption / decryption circuit, A first AddRoundKey conversion module; A second AddRoundKey conversion module; A third AddRoundKey conversion module; A first ShiftRows conversion module; A second ShiftRows conversion module; A first SubBytes transform module; A second SubBytes transform module; A first MixColumns conversion module; A second MixColumns conversion module; And Data holding unit Including; AES encryption / decryption circuitry, in the cycle of encryption, executing the first AddRoundKey conversion module, the second AddRoundKey conversion module, and the third AddRoundKey conversion module using different round keys. The method of claim 9, In the first clock cycle of encryption, the first AddRoundKey transformation, the first SubBytes transformation, the first ShiftRows transformation, the first MixColumns transformation, the second AddRoundKey transformation, the second SubBytes transformation, the second ShiftRows transformation, and the second for the plain text data. Outputting the result obtained by performing the MixColumns conversion to the data holding unit, From the second clock cycle to the (NR / 2-1) th clock cycle, where NR is the number of rounds, the first AddRoundKey conversion, the first SubBytes conversion, the first ShiftRows conversion, and the first for the output data of the data holding part. Outputting the result obtained by performing the MixColumns transformation, the second AddRoundKey transformation, the second SubBytes transformation, the second ShiftRows transformation, and the second MixColumns transformation, In the (NR / 2) th clock cycle, the first AddRoundKey conversion, the first SubBytes conversion, the first ShiftRows conversion, the first MixColumns conversion, the second AddRoundKey conversion, the second SubBytes conversion, and the second data for the output data of the data holding part. An AES encryption / decryption circuit for outputting the result obtained by performing ShiftRows conversion and third AddRoundKey conversion to the data holding unit. AES encryption / decryption circuit, A first AddRoundKey conversion module; A second AddRoundKey conversion module; A third AddRoundKey conversion module; A first InvShiftRows transformation module; A second InvShiftRows transform module; A first InvSubBytes conversion module; A second InvSubBytes conversion module; A first InvMixColumns transformation module; A second InvMixColumns conversion module; And Data holding unit Including; AES encryption / decryption circuitry, in the cycle of decryption, executing the first AddRoundKey transform module, the second AddRoundKey transform module, and the third AddRoundKey transform module using different round keys. The method of claim 11, In the first clock cycle of decryption, a first AddRoundKey transformation, a first InvSubBytes transformation, a first InvShiftRows transformation, a first InvMixColumns transformation, a second AddRoundKey transformation, a second InvSubBytes transformation, a second InvShiftRows transformation, and a second ciphertext data. Outputs the result obtained by performing InvMixColumns conversion to the data retainer, From the second clock cycle to the (NR / 2-1) th clock cycle, where NR is the number of rounds, the first AddRoundKey transformation, the first InvSubBytes transformation, the first InvShiftRows transformation, and the first Outputting the result obtained by executing an InvMixColumns transformation, a second AddRoundKey transformation, a second InvSubBytes transformation, a second InvShiftRows transformation, and a second InvMixColumns transformation, to the data holding unit, In the (NR / 2) th clock cycle, the first AddRoundKey conversion, the first InvSubBytes conversion, the first InvShiftRows conversion, the first InvMixColumns conversion, the second AddRoundKey conversion, the second InvSubBytes conversion, and the second An AES encryption / decryption circuit for outputting the result obtained by performing InvShiftRows conversion and third AddRoundKey conversion to the data holding unit.

Images